[PATCH 6.12.y] erofs: fix inline data read failure for ztailpacking pclusters

[Zhiguo Niu]

Gao Xiang <hsiangkao at linux.alibaba.com> 于2026年3月11日周三 14:30写道：
>
> Hi Zhiguo,
>
> On 2026/3/11 14:13, Zhiguo Niu wrote:
> > From: Gao Xiang <hsiangkao at linux.alibaba.com>
> >
> > [ Upstream commit c134a40f86efb8d6b5a949ef70e06d5752209be5 ]
> >
> > Compressed folios for ztailpacking pclusters must be valid before adding
> > these pclusters to I/O chains. Otherwise, z_erofs_decompress_pcluster()
> > may assume they are already valid and then trigger a NULL pointer
> > dereference.
> >
> > It is somewhat hard to reproduce because the inline data is in the same
> > block as the tail of the compressed indexes, which are usually read just
> > before. However, it may still happen if a fatal signal arrives while
> > read_mapping_folio() is running, as shown below:
> >
> >   erofs: (device dm-1): z_erofs_pcluster_begin: failed to get inline data -4
> >   Unable to handle kernel NULL pointer dereference at virtual address 0000000000000008
> >
> >   ...
> >
> >   pc : z_erofs_decompress_queue+0x4c8/0xa14
> >   lr : z_erofs_decompress_queue+0x160/0xa14
> >   sp : ffffffc08b3eb3a0
> >   x29: ffffffc08b3eb570 x28: ffffffc08b3eb418 x27: 0000000000001000
> >   x26: ffffff8086ebdbb8 x25: ffffff8086ebdbb8 x24: 0000000000000001
> >   x23: 0000000000000008 x22: 00000000fffffffb x21: dead000000000700
> >   x20: 00000000000015e7 x19: ffffff808babb400 x18: ffffffc089edc098
> >   x17: 00000000c006287d x16: 00000000c006287d x15: 0000000000000004
> >   x14: ffffff80ba8f8000 x13: 0000000000000004 x12: 00000006589a77c9
> >   x11: 0000000000000015 x10: 0000000000000000 x9 : 0000000000000000
> >   x8 : 0000000000000000 x7 : 0000000000000000 x6 : 000000000000003f
> >   x5 : 0000000000000040 x4 : ffffffffffffffe0 x3 : 0000000000000020
> >   x2 : 0000000000000008 x1 : 0000000000000000 x0 : 0000000000000000
> >   Call trace:
> >    z_erofs_decompress_queue+0x4c8/0xa14
> >    z_erofs_runqueue+0x908/0x97c
> >    z_erofs_read_folio+0x128/0x228
> >    filemap_read_folio+0x68/0x128
> >    filemap_get_pages+0x44c/0x8b4
> >    filemap_read+0x12c/0x5b8
> >    generic_file_read_iter+0x4c/0x15c
> >    do_iter_readv_writev+0x188/0x1e0
> >    vfs_iter_read+0xac/0x1a4
> >    backing_file_read_iter+0x170/0x34c
> >    ovl_read_iter+0xf0/0x140
> >    vfs_read+0x28c/0x344
> >    ksys_read+0x80/0xf0
> >    __arm64_sys_read+0x24/0x34
> >    invoke_syscall+0x60/0x114
> >    el0_svc_common+0x88/0xe4
> >    do_el0_svc+0x24/0x30
> >    el0_svc+0x40/0xa8
> >    el0t_64_sync_handler+0x70/0xbc
> >    el0t_64_sync+0x1bc/0x1c0
> >
> > Fix this by reading the inline data before allocating and adding
> > the pclusters to the I/O chains.
> >
> > Fixes: cecf864d3d76 ("erofs: support inline data decompression")
> > Reported-by: Zhiguo Niu <zhiguo.niu at unisoc.com>
> > Reviewed-and-tested-by: Zhiguo Niu <zhiguo.niu at unisoc.com>
> > Signed-off-by: Gao Xiang <hsiangkao at linux.alibaba.com>
> > Signed-off-by: Zhiguo Niu <zhiguo.niu at unisoc.com>
> > ---
> >   fs/erofs/zdata.c | 21 +++++++++++----------
> >   1 file changed, 11 insertions(+), 10 deletions(-)
> >
> > diff --git a/fs/erofs/zdata.c b/fs/erofs/zdata.c
> > index 7116f20..0b3ca62 100644
> > --- a/fs/erofs/zdata.c
> > +++ b/fs/erofs/zdata.c
> > @@ -788,6 +788,7 @@ static int z_erofs_pcluster_begin(struct z_erofs_frontend *fe)
> >       erofs_blk_t blknr = erofs_blknr(sb, map->m_pa);
> >       struct z_erofs_pcluster *pcl = NULL;
> >       int ret;
> > +     void *mptr = NULL;
>
Hi Xiang,
> let's align with the upstream naming and ordering?
>
>         void *ptr = NULL;
>         int ret;
OK
>
> >
> >       DBG_BUGON(fe->pcl);
> >       /* must be Z_EROFS_PCLUSTER_TAIL or pointed to previous pcluster */
> > @@ -807,6 +808,14 @@ static int z_erofs_pcluster_begin(struct z_erofs_frontend *fe)
> >       } else if ((map->m_pa & ~PAGE_MASK) + map->m_plen > PAGE_SIZE) {
> >               DBG_BUGON(1);
> >               return -EFSCORRUPTED;
> > +     } else {
> > +             mptr = erofs_read_metabuf(&map->buf, sb, map->m_pa, EROFS_NO_KMAP);
> > +             if (IS_ERR(mptr)) {
> > +                     ret = PTR_ERR(mptr);
> > +                     erofs_err(sb, "failed to get inline data %d", ret);
>
> Could you retain the upstream error report? like:
>                         erofs_err(sb, "failed to read inline data %pe @ pa %llu of nid %llu",
>                                   mptr, map->m_pa, EROFS_I(fe->inode)->nid);
>
> Otherwise it looks good to me.
>
> When you send the next version, please send the patch
> to Greg as well.
got it.
Thanks!
>
> Thanks,
> Gao Xiang
>
> > +                     return ret;
> > +             }
> > +             mptr = map->buf.page;
> >       }
> >
> >       if (pcl) {
> > @@ -836,16 +845,8 @@ static int z_erofs_pcluster_begin(struct z_erofs_frontend *fe)
> >               /* bind cache first when cached decompression is preferred */
> >               z_erofs_bind_cache(fe);
> >       } else {
> > -             void *mptr;
> > -
> > -             mptr = erofs_read_metabuf(&map->buf, sb, map->m_pa, EROFS_NO_KMAP);
> > -             if (IS_ERR(mptr)) {
> > -                     ret = PTR_ERR(mptr);
> > -                     erofs_err(sb, "failed to get inline data %d", ret);
> > -                     return ret;
> > -             }
> > -             get_page(map->buf.page);
> > -             WRITE_ONCE(fe->pcl->compressed_bvecs[0].page, map->buf.page);
> > +             get_page((struct page *)mptr);
> > +             WRITE_ONCE(fe->pcl->compressed_bvecs[0].page, mptr);
> >               fe->pcl->pageofs_in = map->m_pa & ~PAGE_MASK;
> >               fe->mode = Z_EROFS_PCLUSTER_FOLLOWED_NOINPLACE;
> >       }
>