In fscache mode a compressed read uses one pseudo-bio whose io->end_io is
erofs_fscache_bio_endio(). When prepare_ondemand_read() splits the read at
a cached/uncached boundary, erofs_fscache_read_io_async() issues several
fscache subreads on the same bio and erofs_fscache_bio_endio() calls
bio_endio() on each. The pseudo-bio is not chained, so z_erofs_endio()
runs once per subread while z_erofs_submit_queue() counted the bio only
once, underflowing pending_bios: the reader hangs in D state, or, on async
completion, the first completion frees the decompress queue and the rest
are use-after-free.
Hold a bio_inc_remaining() reference per issued subread and drop the
submitter's initial reference with one bio_endio() once submission
finishes, so the bio completes exactly once. The request path
(erofs_fscache_req_end_io) is unaffected; it uses its own refcount and
never calls bio_endio().
Fixes: a1bafc3109d7 ("erofs: support compressed inodes over fscache")
Cc: [email protected]
Signed-off-by: Michael Bommarito <[email protected]>
Assisted-by: Claude:claude-opus-4-7
---
Reproduced on x86-64 with KASAN via the erofs-on-demand path (a cachefiles
ondemand daemon serving a crafted compressed image that splits a pcluster
read). Found with the help of an automated review tool.
Without this patch a stock kernel either hangs the reader:
task:dd state:D
filemap_get_pages / erofs_file_read_iter
or, when completion is asynchronous, faults:
BUG: KASAN: slab-use-after-free in z_erofs_endio
Kernel panic - not syncing: Fatal exception in interrupt
With this patch the same daemon, image and reads complete cleanly: no
hang, no KASAN report, no panic. Harness and full logs available on
request.
fs/erofs/fscache.c | 27 ++++++++++++++++++---------
1 file changed, 18 insertions(+), 9 deletions(-)
diff --git a/fs/erofs/fscache.c b/fs/erofs/fscache.c
index 685c68774379b..0cce498faa32d 100644
--- a/fs/erofs/fscache.c
+++ b/fs/erofs/fscache.c
@@ -29,6 +29,14 @@ struct erofs_fscache_rq {
refcount_t ref;
};
+struct erofs_fscache_bio {
+ struct erofs_fscache_io io;
+ struct bio bio; /* w/o bdev to share bio_add_page/endio() */
+ struct bio_vec bvecs[BIO_MAX_VECS];
+};
+
+static void erofs_fscache_bio_endio(void *priv, ssize_t transferred_or_error);
+
static bool erofs_fscache_io_put(struct erofs_fscache_io *io)
{
if (!refcount_dec_and_test(&io->ref))
@@ -122,8 +130,13 @@ static int erofs_fscache_read_io_async(struct
fscache_cookie *cookie,
enum netfs_io_source source;
struct netfs_cache_resources *cres = &io->cres;
struct iov_iter *iter = &io->iter;
+ struct bio *bio = NULL;
int ret;
+ /* Chain-account a split pseudo-bio so it completes only once. */
+ if (io->end_io == erofs_fscache_bio_endio)
+ bio = &container_of(io, struct erofs_fscache_bio, io)->bio;
+
ret = fscache_begin_read_operation(cres, cookie);
if (ret)
return ret;
@@ -143,6 +156,8 @@ static int erofs_fscache_read_io_async(struct
fscache_cookie *cookie,
iov_iter_truncate(iter, len);
refcount_inc(&io->ref);
+ if (bio)
+ bio_inc_remaining(bio);
ret = fscache_read(cres, pstart, iter, NETFS_READ_HOLE_FAIL,
io->end_io, io);
if (ret == -EIOCBQUEUED)
@@ -160,12 +175,6 @@ static int erofs_fscache_read_io_async(struct
fscache_cookie *cookie,
return 0;
}
-struct erofs_fscache_bio {
- struct erofs_fscache_io io;
- struct bio bio; /* w/o bdev to share bio_add_page/endio() */
- struct bio_vec bvecs[BIO_MAX_VECS];
-};
-
static void erofs_fscache_bio_endio(void *priv, ssize_t transferred_or_error)
{
struct erofs_fscache_bio *io = priv;
@@ -200,9 +209,9 @@ void erofs_fscache_submit_bio(struct bio *bio)
ret = erofs_fscache_read_io_async(io->io.private,
bio->bi_iter.bi_sector << 9, &io->io);
erofs_fscache_io_put(&io->io);
- if (!ret)
- return;
- bio->bi_status = errno_to_blk_status(ret);
+ if (ret)
+ bio->bi_status = errno_to_blk_status(ret);
+ /* Drop the submitter's ref; subread chain refs complete the bio. */
bio_endio(bio);
}
--
2.53.0
