linux-kernel - Re: [PATCH for-4.19] staging: erofs: fix mis-acted TAIL merging behavior

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 7 Mar 2019 16:21:47 +0100
From:   Greg KH <greg@...ah.com>
To:     Gao Xiang <gaoxiang25@...wei.com>
Cc:     Sasha Levin <sashal@...nel.org>, Chao Yu <yuchao0@...wei.com>,
        LKML <linux-kernel@...r.kernel.org>,
        linux-erofs@...ts.ozlabs.org, stable@...r.kernel.org
Subject: Re: [PATCH for-4.19] staging: erofs: fix mis-acted TAIL merging
 behavior

On Thu, Mar 07, 2019 at 09:04:06PM +0800, Gao Xiang wrote:
> Hi Greg,
> 
> On 2019/3/7 20:25, Greg KH wrote:
> > On Thu, Mar 07, 2019 at 01:34:04PM +0800, Gao Xiang wrote:
> >> commit a112152f6f3a2a88caa6f414d540bd49e406af60 upstream.
> >>
> >> EROFS has an optimized path called TAIL merging, which is designed
> >> to merge multiple reads and the corresponding decompressions into
> >> one if these requests read continuous pages almost at the same time.
> >>
> >> In general, it behaves as follows:
> >>  ________________________________________________________________
> >>   ... |  TAIL  .  HEAD  |  PAGE  |  PAGE  |  TAIL    . HEAD | ...
> >>  _____|_combined page A_|________|________|_combined page B_|____
> >>         1  ]  ->  [  2                          ]  ->  [ 3
> >> If the above three reads are requested in the order 1-2-3, it will
> >> generate a large work chain rather than 3 individual work chains
> >> to reduce scheduling overhead and boost up sequential read.
> >>
> >> However, if Read 2 is processed slightly earlier than Read 1,
> >> currently it still generates 2 individual work chains (chain 1, 2)
> >> but it does in-place decompression for combined page A, moreover,
> >> if chain 2 decompresses ahead of chain 1, it will be a race and
> >> lead to corrupted decompressed page. This patch fixes it.
> >>
> >> Fixes: 3883a79abd02 ("staging: erofs: introduce VLE decompression support")
> >> Cc: <stable@...r.kernel.org> # 4.19+
> >> Signed-off-by: Gao Xiang <gaoxiang25@...wei.com>
> >> Reviewed-by: Chao Yu <yuchao0@...wei.com>
> >> ---
> >>  drivers/staging/erofs/unzip_vle.c | 69 +++++++++++++++++++++++++--------------
> >>  1 file changed, 44 insertions(+), 25 deletions(-)
> >>
> > 
> > thanks for the backport, now applied.
> 
> Yes, it seems that Sasha's bot cannot cherry-pick it directly,
> therefore I made this patch for 4.19 by hand...
> 
> BTW, there is another patch called "staging: erofs: compressed_pages should not be accessed again after freed"
> in the same condition... And I also send 4.19 and 4.20 version to stable mailing list,
> could you also kindly check them out?

Yes, please give me a chance to catch up on stable pending patches to
process:

	$ mdfrm -c ~/mail/stable/
	585 messages in /home/gregkh/mail/stable/

You are in good company :)

greg k-h