Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
From:   Chen Zhongjin <chenzhongjin@huawei.com>
To:     <syzbot+6f8cd9a0155b366d227f@syzkaller.appspotmail.com>,
        <linux-erofs@lists.ozlabs.org>, <linux-kernel@vger.kernel.org>
CC:     <chenzhongjin@huawei.com>, <xiang@kernel.org>, <chao@kernel.org>,
        <huyue2@coolpad.com>, <jefflexu@linux.alibaba.com>
Subject: [PATCH] erofs: Fix pcluster become inline when m_pa is zero
Date:   Sat, 3 Dec 2022 17:45:27 +0800
Message-ID: <20221203094527.129869-1-chenzhongjin@huawei.com>
MIME-Version: 1.0
Content-Type: text/plain
Precedence: bulk

syzkaller reported a memleak:
https://syzkaller.appspot.com/bug?id=62f37ff612f0021641eda5b17f056f1668aa9aed

unreferenced object 0xffff88811009c7f8 (size 136):
  ...
  backtrace:
    [<ffffffff821db19b>] z_erofs_do_read_page+0x99b/0x1740
    [<ffffffff821dee9e>] z_erofs_readahead+0x24e/0x580
    [<ffffffff814bc0d6>] read_pages+0x86/0x3d0
    ...

syzkaller constructed a case: in z_erofs_register_pcluster(),
ztailpacking = false and map->m_pa = zero. This makes pcl->obj.index
become zero although pcl is not an inline pcluster.

Then following path adds refcount for grp, but the it won't be put
because pcl is inline, which makes pcl not released when shrink.

z_erofs_readahead()
  z_erofs_do_read_page() # for another page
    z_erofs_collector_begin()
      erofs_find_workgroup()
        erofs_workgroup_get()

To fix this, add an attribute in z_erofs_pcluster to mark the inline
state which not depends on index of grp.

Fixes: cecf864d3d76 ("erofs: support inline data decompression")
Reported-by: syzbot+6f8cd9a0155b366d227f@syzkaller.appspotmail.com
Signed-off-by: Chen Zhongjin <chenzhongjin@huawei.com>
---
 fs/erofs/zdata.c | 2 +-
 fs/erofs/zdata.h | 5 ++++-
 2 files changed, 5 insertions(+), 2 deletions(-)

diff --git a/fs/erofs/zdata.c b/fs/erofs/zdata.c
index b792d424d774..fef2624d19e3 100644
--- a/fs/erofs/zdata.c
+++ b/fs/erofs/zdata.c
@@ -517,7 +517,7 @@ static int z_erofs_register_pcluster(struct z_erofs_decompress_frontend *fe)
 	DBG_BUGON(!mutex_trylock(&pcl->lock));
 
 	if (ztailpacking) {
-		pcl->obj.index = 0;	/* which indicates ztailpacking */
+		pcl->is_inline = true;  /* which indicates ztailpacking */
 		pcl->pageofs_in = erofs_blkoff(map->m_pa);
 		pcl->tailpacking_size = map->m_plen;
 	} else {
diff --git a/fs/erofs/zdata.h b/fs/erofs/zdata.h
index d98c95212985..35051ad27521 100644
--- a/fs/erofs/zdata.h
+++ b/fs/erofs/zdata.h
@@ -78,6 +78,9 @@ struct z_erofs_pcluster {
 		unsigned short tailpacking_size;
 	};
 
+	/* I:  whether it is inline or not */
+	bool is_inline;
+
 	/* I: compression algorithm format */
 	unsigned char algorithmformat;
 
@@ -115,7 +118,7 @@ struct z_erofs_decompressqueue {
 
 static inline bool z_erofs_is_inline_pcluster(struct z_erofs_pcluster *pcl)
 {
-	return !pcl->obj.index;
+	return pcl->is_inline;
 }
 
 static inline unsigned int z_erofs_pclusterpages(struct z_erofs_pcluster *pcl)
-- 
2.17.1