Skip to content

Commit 56ee254

Browse files
committed
Revert "btrfs: compression: drop kmap/kunmap from zstd"
This reverts commit bbaf971. The kmaps in compression code are still needed and cause crashes on 32bit machines (ARM, x86). Reproducible eg. by running fstest btrfs/004 with enabled LZO or ZSTD compression. Example stacktrace with ZSTD on a 32bit ARM machine: Unable to handle kernel NULL pointer dereference at virtual address 00000000 pgd = c4159ed3 [00000000] *pgd=00000000 Internal error: Oops: 5 [#1] PREEMPT SMP ARM Modules linked in: CPU: 0 PID: 210 Comm: kworker/u2:3 Not tainted 5.14.0-rc79+ #12 Hardware name: Allwinner sun4i/sun5i Families Workqueue: btrfs-delalloc btrfs_work_helper PC is at mmiocpy+0x48/0x330 LR is at ZSTD_compressStream_generic+0x15c/0x28c (mmiocpy) from [<c0629648>] (ZSTD_compressStream_generic+0x15c/0x28c) (ZSTD_compressStream_generic) from [<c06297dc>] (ZSTD_compressStream+0x64/0xa0) (ZSTD_compressStream) from [<c049444c>] (zstd_compress_pages+0x170/0x488) (zstd_compress_pages) from [<c0496798>] (btrfs_compress_pages+0x124/0x12c) (btrfs_compress_pages) from [<c043c068>] (compress_file_range+0x3c0/0x834) (compress_file_range) from [<c043c4ec>] (async_cow_start+0x10/0x28) (async_cow_start) from [<c0475c3c>] (btrfs_work_helper+0x100/0x230) (btrfs_work_helper) from [<c014ef68>] (process_one_work+0x1b4/0x418) (process_one_work) from [<c014f210>] (worker_thread+0x44/0x524) (worker_thread) from [<c0156aa4>] (kthread+0x180/0x1b0) (kthread) from [<c0100150>] Link: https://lore.kernel.org/all/CAJCQCtT+OuemovPO7GZk8Y8=qtOObr0XTDp8jh4OHD6y84AFxw@mail.gmail.com/ Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=214839 Signed-off-by: David Sterba <[email protected]>
1 parent 3a60f65 commit 56ee254

File tree

1 file changed

+18
-9
lines changed

1 file changed

+18
-9
lines changed

fs/btrfs/zstd.c

Lines changed: 18 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -399,7 +399,7 @@ int zstd_compress_pages(struct list_head *ws, struct address_space *mapping,
399399

400400
/* map in the first page of input data */
401401
in_page = find_get_page(mapping, start >> PAGE_SHIFT);
402-
workspace->in_buf.src = page_address(in_page);
402+
workspace->in_buf.src = kmap(in_page);
403403
workspace->in_buf.pos = 0;
404404
workspace->in_buf.size = min_t(size_t, len, PAGE_SIZE);
405405

@@ -411,7 +411,7 @@ int zstd_compress_pages(struct list_head *ws, struct address_space *mapping,
411411
goto out;
412412
}
413413
pages[nr_pages++] = out_page;
414-
workspace->out_buf.dst = page_address(out_page);
414+
workspace->out_buf.dst = kmap(out_page);
415415
workspace->out_buf.pos = 0;
416416
workspace->out_buf.size = min_t(size_t, max_out, PAGE_SIZE);
417417

@@ -446,6 +446,7 @@ int zstd_compress_pages(struct list_head *ws, struct address_space *mapping,
446446
if (workspace->out_buf.pos == workspace->out_buf.size) {
447447
tot_out += PAGE_SIZE;
448448
max_out -= PAGE_SIZE;
449+
kunmap(out_page);
449450
if (nr_pages == nr_dest_pages) {
450451
out_page = NULL;
451452
ret = -E2BIG;
@@ -457,7 +458,7 @@ int zstd_compress_pages(struct list_head *ws, struct address_space *mapping,
457458
goto out;
458459
}
459460
pages[nr_pages++] = out_page;
460-
workspace->out_buf.dst = page_address(out_page);
461+
workspace->out_buf.dst = kmap(out_page);
461462
workspace->out_buf.pos = 0;
462463
workspace->out_buf.size = min_t(size_t, max_out,
463464
PAGE_SIZE);
@@ -472,12 +473,13 @@ int zstd_compress_pages(struct list_head *ws, struct address_space *mapping,
472473
/* Check if we need more input */
473474
if (workspace->in_buf.pos == workspace->in_buf.size) {
474475
tot_in += PAGE_SIZE;
476+
kunmap(in_page);
475477
put_page(in_page);
476478

477479
start += PAGE_SIZE;
478480
len -= PAGE_SIZE;
479481
in_page = find_get_page(mapping, start >> PAGE_SHIFT);
480-
workspace->in_buf.src = page_address(in_page);
482+
workspace->in_buf.src = kmap(in_page);
481483
workspace->in_buf.pos = 0;
482484
workspace->in_buf.size = min_t(size_t, len, PAGE_SIZE);
483485
}
@@ -504,6 +506,7 @@ int zstd_compress_pages(struct list_head *ws, struct address_space *mapping,
504506

505507
tot_out += PAGE_SIZE;
506508
max_out -= PAGE_SIZE;
509+
kunmap(out_page);
507510
if (nr_pages == nr_dest_pages) {
508511
out_page = NULL;
509512
ret = -E2BIG;
@@ -515,7 +518,7 @@ int zstd_compress_pages(struct list_head *ws, struct address_space *mapping,
515518
goto out;
516519
}
517520
pages[nr_pages++] = out_page;
518-
workspace->out_buf.dst = page_address(out_page);
521+
workspace->out_buf.dst = kmap(out_page);
519522
workspace->out_buf.pos = 0;
520523
workspace->out_buf.size = min_t(size_t, max_out, PAGE_SIZE);
521524
}
@@ -531,8 +534,12 @@ int zstd_compress_pages(struct list_head *ws, struct address_space *mapping,
531534
out:
532535
*out_pages = nr_pages;
533536
/* Cleanup */
534-
if (in_page)
537+
if (in_page) {
538+
kunmap(in_page);
535539
put_page(in_page);
540+
}
541+
if (out_page)
542+
kunmap(out_page);
536543
return ret;
537544
}
538545

@@ -556,7 +563,7 @@ int zstd_decompress_bio(struct list_head *ws, struct compressed_bio *cb)
556563
goto done;
557564
}
558565

559-
workspace->in_buf.src = page_address(pages_in[page_in_index]);
566+
workspace->in_buf.src = kmap(pages_in[page_in_index]);
560567
workspace->in_buf.pos = 0;
561568
workspace->in_buf.size = min_t(size_t, srclen, PAGE_SIZE);
562569

@@ -592,21 +599,23 @@ int zstd_decompress_bio(struct list_head *ws, struct compressed_bio *cb)
592599
break;
593600

594601
if (workspace->in_buf.pos == workspace->in_buf.size) {
595-
page_in_index++;
602+
kunmap(pages_in[page_in_index++]);
596603
if (page_in_index >= total_pages_in) {
597604
workspace->in_buf.src = NULL;
598605
ret = -EIO;
599606
goto done;
600607
}
601608
srclen -= PAGE_SIZE;
602-
workspace->in_buf.src = page_address(pages_in[page_in_index]);
609+
workspace->in_buf.src = kmap(pages_in[page_in_index]);
603610
workspace->in_buf.pos = 0;
604611
workspace->in_buf.size = min_t(size_t, srclen, PAGE_SIZE);
605612
}
606613
}
607614
ret = 0;
608615
zero_fill_bio(cb->orig_bio);
609616
done:
617+
if (workspace->in_buf.src)
618+
kunmap(pages_in[page_in_index]);
610619
return ret;
611620
}
612621

0 commit comments

Comments
 (0)