From patchwork Fri Jun 19 09:00:53 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: =?utf-8?b?6YeR57qi5a6HIChIb25neXUgSmluKQ==?= X-Patchwork-Id: 224282 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-3.5 required=3.0 tests=CHARSET_FARAWAY_HEADER, HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_PATCH, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE, SPF_PASS autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id A471AC433E0 for ; Fri, 19 Jun 2020 09:33:36 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 830762073E for ; Fri, 19 Jun 2020 09:33:36 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1731151AbgFSJd3 (ORCPT ); Fri, 19 Jun 2020 05:33:29 -0400 Received: from sci-ig2.spreadtrum.com ([222.66.158.135]:34936 "EHLO SHSQR01.unisoc.com" rhost-flags-OK-FAIL-OK-FAIL) by vger.kernel.org with ESMTP id S1732083AbgFSJc2 (ORCPT ); Fri, 19 Jun 2020 05:32:28 -0400 Received: from SHSQR01.spreadtrum.com (localhost [127.0.0.2] (may be forged)) by SHSQR01.unisoc.com with ESMTP id 05J91tkU012801 for ; Fri, 19 Jun 2020 17:01:55 +0800 (CST) (envelope-from hongyu.jin@unisoc.com) Received: from ig2.spreadtrum.com (bjmbx01.spreadtrum.com [10.0.64.7]) by SHSQR01.spreadtrum.com with ESMTPS id 05J90rqt009148 (version=TLSv1 cipher=AES256-SHA bits=256 verify=NO); Fri, 19 Jun 2020 17:00:54 +0800 (CST) (envelope-from hongyu.jin@unisoc.com) Received: from BJMBX01.spreadtrum.com (10.0.64.7) by BJMBX01.spreadtrum.com (10.0.64.7) with Microsoft SMTP Server (TLS) id 15.0.847.32; Fri, 19 Jun 2020 17:00:53 +0800 Received: from BJMBX01.spreadtrum.com ([fe80::54e:9a:129d:fac7]) by BJMBX01.spreadtrum.com ([fe80::54e:9a:129d:fac7%16]) with mapi id 15.00.0847.030; Fri, 19 Jun 2020 17:00:53 +0800 From: =?gb2312?b?vfC67NPuIChIb25neXUgSmluKQ==?= To: Gao Xiang , "linux-erofs@lists.ozlabs.org" , Chao Yu CC: Chao Yu , Li Guifu , Fang Wei , LKML , Gao Xiang , "stable@vger.kernel.org" Subject: [PATCH v2] erofs: fix partially uninitialized misuse in z_erofs_onlinepage_fixup Thread-Topic: [PATCH v2] erofs: fix partially uninitialized misuse in z_erofs_onlinepage_fixup Thread-Index: AQHWRcphTFCNsOawuk2LQqgGLvVLoajfooAF Date: Fri, 19 Jun 2020 09:00:53 +0000 Message-ID: <37ee181865a6411bb029745b809adae9@BJMBX01.spreadtrum.com> References: <20200618111936.19845-1-hsiangkao@aol.com>, <20200618234349.22553-1-hsiangkao@aol.com> In-Reply-To: <20200618234349.22553-1-hsiangkao@aol.com> Accept-Language: zh-CN, en-US Content-Language: zh-CN X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [10.0.74.65] MIME-Version: 1.0 X-MAIL: SHSQR01.spreadtrum.com 05J90rqt009148 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org Hi xiang: Hongyu reported "id != index" in z_erofs_onlinepage_fixup() with specific aarch64 environment easily, which wasn't shown before. After digging into that, I found that high 32 bits of page->private was set to 0xaaaaaaaa rather than 0 (due to z_erofs_onlinepage_init behavior with specific compiler options). Actually we only use low 32 bits to keep the page information since page->private is only 4 bytes on most 32-bit platforms. However z_erofs_onlinepage_fixup() uses the upper 32 bits by mistake. Tested-by: hongyu.jin@unisoc.com it's ok. ________________________________________ 发件人: Gao Xiang 发送时间: 2020年6月19日 7:43 收件人: linux-erofs@lists.ozlabs.org; Chao Yu 抄送: Chao Yu; Li Guifu; Fang Wei; LKML; Gao Xiang; 金红宇 (Hongyu Jin); stable@vger.kernel.org 主题: [PATCH v2] erofs: fix partially uninitialized misuse in z_erofs_onlinepage_fixup From: Gao Xiang Hongyu reported "id != index" in z_erofs_onlinepage_fixup() with specific aarch64 environment easily, which wasn't shown before. After digging into that, I found that high 32 bits of page->private was set to 0xaaaaaaaa rather than 0 (due to z_erofs_onlinepage_init behavior with specific compiler options). Actually we only use low 32 bits to keep the page information since page->private is only 4 bytes on most 32-bit platforms. However z_erofs_onlinepage_fixup() uses the upper 32 bits by mistake. Let's fix it now. Reported-by: Hongyu Jin Fixes: 3883a79abd02 ("staging: erofs: introduce VLE decompression support") Cc: # 4.19+ Signed-off-by: Gao Xiang --- change since v1: move .v assignment out since it doesn't need for every loop; fs/erofs/zdata.h | 20 ++++++++++---------- 1 file changed, 10 insertions(+), 10 deletions(-) -- 2.24.0 ________________________________ This email (including its attachments) is intended only for the person or entity to which it is addressed and may contain information that is privileged, confidential or otherwise protected from disclosure. Unauthorized use, dissemination, distribution or copying of this email or the information herein or taking any action in reliance on the contents of this email or the information herein, by anyone other than the intended recipient, or an employee or agent responsible for delivering the message to the intended recipient, is strictly prohibited. If you are not the intended recipient, please do not read, copy, use or disclose any part of this e-mail to others. Please notify the sender immediately and permanently delete this e-mail and any attachments if you received it in error. Internet communications cannot be guaranteed to be timely, secure, error-free or virus-free. The sender does not accept liability for any errors or omissions. 本邮件及其附件具有保密性质，受法律保护不得泄露，仅发送给本邮件所指特定收件人。严禁非经授权使用、宣传、发布或复制本邮件或其内容。若非该特定收件人，请勿阅读、复制、 使用或披露本邮件的任何内容。若误收本邮件，请从系统中永久性删除本邮件及所有附件，并以回复邮件的方式即刻告知发件人。无法保证互联网通信及时、安全、无误或防毒。发件人对任何错漏均不承担责任。 diff --git a/fs/erofs/zdata.h b/fs/erofs/zdata.h index 7824f5563a55..9b66c28b3ae9 100644 --- a/fs/erofs/zdata.h +++ b/fs/erofs/zdata.h @@ -144,22 +144,22 @@ static inline void z_erofs_onlinepage_init(struct page *page) static inline void z_erofs_onlinepage_fixup(struct page *page, uintptr_t index, bool down) { - unsigned long *p, o, v, id; -repeat: - p = &page_private(page); - o = READ_ONCE(*p); + union z_erofs_onlinepage_converter u = { .v = &page_private(page) }; + int orig, orig_index, val; - id = o >> Z_EROFS_ONLINEPAGE_INDEX_SHIFT; - if (id) { +repeat: + orig = atomic_read(u.o); + orig_index = orig >> Z_EROFS_ONLINEPAGE_INDEX_SHIFT; + if (orig_index) { if (!index) return; - DBG_BUGON(id != index); + DBG_BUGON(orig_index != index); } - v = (index << Z_EROFS_ONLINEPAGE_INDEX_SHIFT) | - ((o & Z_EROFS_ONLINEPAGE_COUNT_MASK) + (unsigned int)down); - if (cmpxchg(p, o, v) != o) + val = (index << Z_EROFS_ONLINEPAGE_INDEX_SHIFT) | + ((orig & Z_EROFS_ONLINEPAGE_COUNT_MASK) + (unsigned int)down); + if (atomic_cmpxchg(u.o, orig, val) != orig) goto repeat; }