linux-stable.git/fs/squashfs, branch v6.14 Linux kernel stable tree squashfs: fix invalid pointer dereference in squashfs_cache_delete 2025-03-17T00:40:24+00:00 Zhiyu Zhang zhiyuzhang999@gmail.com 2025-03-06T13:28:55+00:00 d7147a33570ce07965d76e4491c7c9d8d38006f4 When mounting a squashfs fails, squashfs_cache_init() may return an error pointer (e.g., -ENOMEM) instead of NULL. However, squashfs_cache_delete() only checks for a NULL cache, and attempts to dereference the invalid pointer. This leads to a kernel crash (BUG: unable to handle kernel paging request in squashfs_cache_delete). This patch fixes the issue by checking IS_ERR(cache) before accessing it. Link: https://lkml.kernel.org/r/20250306132855.2030-1-zhiyuzhang999@gmail.com Fixes: 49ff29240ebb ("squashfs: make squashfs_cache_init() return ERR_PTR(-ENOMEM)") Signed-off-by: Zhiyu Zhang <zhiyuzhang999@gmail.com> Reported-by: Zhiyu Zhang <zhiyuzhang999@gmail.com> Closes: https://lore.kernel.org/linux-fsdevel/CALf2hKvaq8B4u5yfrE+BYt7aNguao99mfWxHngA+=o5hwzjdOg@mail.gmail.com/ Tested-by: Zhiyu Zhang <zhiyuzhang999@gmail.com> Reviewed-by: Phillip Lougher <phillip@squashfs.org.uk> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> 
When mounting a squashfs fails, squashfs_cache_init() may return an error
pointer (e.g., -ENOMEM) instead of NULL.  However, squashfs_cache_delete()
only checks for a NULL cache, and attempts to dereference the invalid
pointer.  This leads to a kernel crash (BUG: unable to handle kernel
paging request in squashfs_cache_delete).

This patch fixes the issue by checking IS_ERR(cache) before accessing it.

Link: https://lkml.kernel.org/r/20250306132855.2030-1-zhiyuzhang999@gmail.com
Fixes: 49ff29240ebb ("squashfs: make squashfs_cache_init() return ERR_PTR(-ENOMEM)")
Signed-off-by: Zhiyu Zhang <zhiyuzhang999@gmail.com>
Reported-by: Zhiyu Zhang <zhiyuzhang999@gmail.com>
Closes: https://lore.kernel.org/linux-fsdevel/CALf2hKvaq8B4u5yfrE+BYt7aNguao99mfWxHngA+=o5hwzjdOg@mail.gmail.com/
Tested-by: Zhiyu Zhang <zhiyuzhang999@gmail.com>
Reviewed-by: Phillip Lougher <phillip@squashfs.org.uk>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
squashfs: convert squashfs_fill_page() to take a folio 2025-01-25T06:47:22+00:00 Matthew Wilcox (Oracle) willy@infradead.org 2024-12-20T22:46:28+00:00 5748be3e9ef4659f9adf7e1ad454fafb0868cd88 squashfs_fill_page is only used in this file, so make it static. Use kmap_local instead of kmap_atomic, and return a bool so that the caller can use folio_end_read() which saves an atomic operation over calling folio_mark_uptodate() followed by folio_unlock(). [willy@infradead.org: fix polarity of "uptodate" Thanks to Ryan for testing] Link: https://lkml.kernel.org/r/20250110163300.3346321-2-willy@infradead.org Link: https://lkml.kernel.org/r/20241220224634.723899-5-willy@infradead.org Signed-off-by: Matthew Wilcox (Oracle) <willy@infradead.org> Tested-by: Ryan Roberts <ryan.roberts@arm.com> Cc: Phillip Lougher <phillip@squashfs.org.uk> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> 
squashfs_fill_page is only used in this file, so make it static.
Use kmap_local instead of kmap_atomic, and return a bool so that
the caller can use folio_end_read() which saves an atomic operation
over calling folio_mark_uptodate() followed by folio_unlock().

[willy@infradead.org: fix polarity of "uptodate" Thanks to Ryan for testing]
  Link: https://lkml.kernel.org/r/20250110163300.3346321-2-willy@infradead.org
Link: https://lkml.kernel.org/r/20241220224634.723899-5-willy@infradead.org
Signed-off-by: Matthew Wilcox (Oracle) <willy@infradead.org>
Tested-by: Ryan Roberts <ryan.roberts@arm.com>
Cc: Phillip Lougher <phillip@squashfs.org.uk>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
squashfs; convert squashfs_copy_cache() to take a folio 2025-01-25T06:47:22+00:00 Matthew Wilcox (Oracle) willy@infradead.org 2024-12-20T22:46:27+00:00 5641371fd0b3703d11809a0ae249aed270cb8add Remove accesses to page->index and page->mapping. Also use folio APIs where available. This code still assumes order 0 folios. [dan.carpenter@linaro.org: fix a NULL vs IS_ERR() bug] Link: https://lkml.kernel.org/r/7b7f44d6-9153-4d7c-b65b-2d78febe6c7a@stanley.mountain Link: https://lkml.kernel.org/r/20241220224634.723899-4-willy@infradead.org Signed-off-by: Matthew Wilcox (Oracle) <willy@infradead.org> Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org> Cc: Phillip Lougher <phillip@squashfs.org.uk> Cc: Dan Carpenter <dan.carpenter@linaro.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> 
Remove accesses to page->index and page->mapping.  Also use folio
APIs where available.  This code still assumes order 0 folios.

[dan.carpenter@linaro.org: fix a NULL vs IS_ERR() bug]
  Link: https://lkml.kernel.org/r/7b7f44d6-9153-4d7c-b65b-2d78febe6c7a@stanley.mountain
Link: https://lkml.kernel.org/r/20241220224634.723899-4-willy@infradead.org
Signed-off-by: Matthew Wilcox (Oracle) <willy@infradead.org>
Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
Cc: Phillip Lougher <phillip@squashfs.org.uk>
Cc: Dan Carpenter <dan.carpenter@linaro.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
squashfs: convert squashfs_readpage_block() to take a folio 2025-01-25T06:47:22+00:00 Matthew Wilcox (Oracle) willy@infradead.org 2024-12-20T22:46:26+00:00 2a7aea59cf4dd4a070c4550fddaffc5a73312cad Remove a few accesses to page->mapping. Link: https://lkml.kernel.org/r/20241220224634.723899-3-willy@infradead.org Signed-off-by: Matthew Wilcox (Oracle) <willy@infradead.org> Cc: Phillip Lougher <phillip@squashfs.org.uk> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> 
Remove a few accesses to page->mapping.

Link: https://lkml.kernel.org/r/20241220224634.723899-3-willy@infradead.org
Signed-off-by: Matthew Wilcox (Oracle) <willy@infradead.org>
Cc: Phillip Lougher <phillip@squashfs.org.uk>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
squashfs: pass a folio to squashfs_readpage_fragment() 2025-01-25T06:47:22+00:00 Matthew Wilcox (Oracle) willy@infradead.org 2024-12-20T22:46:25+00:00 8c1565fcf6392d2f962b7cbc9fde43bfcd175c2f Remove an access to page->mapping. Link: https://lkml.kernel.org/r/20241220224634.723899-2-willy@infradead.org Signed-off-by: Matthew Wilcox (Oracle) <willy@infradead.org> Cc: Phillip Lougher <phillip@squashfs.org.uk> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> 
Remove an access to page->mapping.

Link: https://lkml.kernel.org/r/20241220224634.723899-2-willy@infradead.org
Signed-off-by: Matthew Wilcox (Oracle) <willy@infradead.org>
Cc: Phillip Lougher <phillip@squashfs.org.uk>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
squashfs: use a folio throughout squashfs_read_folio() 2025-01-25T06:47:22+00:00 Matthew Wilcox (Oracle) willy@infradead.org 2024-12-20T22:46:24+00:00 608c2501675cd37260312d35daa2fd6dc6d56e96 Use modern folio APIs where they exist and convert back to struct page for the internal functions. Link: https://lkml.kernel.org/r/20241220224634.723899-1-willy@infradead.org Signed-off-by: Matthew Wilcox (Oracle) <willy@infradead.org> Cc: Phillip Lougher <phillip@squashfs.org.uk> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> 
Use modern folio APIs where they exist and convert back to struct
page for the internal functions.

Link: https://lkml.kernel.org/r/20241220224634.723899-1-willy@infradead.org
Signed-off-by: Matthew Wilcox (Oracle) <willy@infradead.org>
Cc: Phillip Lougher <phillip@squashfs.org.uk>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
squashfs: update Kconfig information 2025-01-25T06:47:22+00:00 Phillip Lougher phillip@squashfs.org.uk 2024-12-29T23:37:52+00:00 d7f4b23c6702e2afbdfe33fe77eedc1584761242 Update the compression algorithms supported, and the Squashfs website location. Link: https://lkml.kernel.org/r/20241229233752.54481-5-phillip@squashfs.org.uk Signed-off-by: Phillip Lougher <phillip@squashfs.org.uk> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> 
Update the compression algorithms supported, and the Squashfs website
location.

Link: https://lkml.kernel.org/r/20241229233752.54481-5-phillip@squashfs.org.uk
Signed-off-by: Phillip Lougher <phillip@squashfs.org.uk>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
squashfs: don't allocate read_page cache if SQUASHFS_FILE_DIRECT configured 2025-01-25T06:47:21+00:00 Phillip Lougher phillip@squashfs.org.uk 2024-12-29T23:37:50+00:00 f5cc08737507f227e5e7e2df52d26ed1f0a7e315 If Squashfs has been configured to directly read datablocks into the page cache (SQUASHFS_FILE_DIRECT), then the read_page cache is unnecessary. This improvement is due to the following two commits, which added the ability to read datablocks into the page cache when pages were missing, enabling the fallback which used an intermediate buffer to be removed. commit f268eedddf359 ("squashfs: extend "page actor" to handle missing pages") commit 1bb1a07afad97 ("squashfs: don't use intermediate buffer if pages missing") This reduces the amount of memory used when mounting a filesystem by block_size * maximum number of threads. Link: https://lkml.kernel.org/r/20241229233752.54481-3-phillip@squashfs.org.uk Signed-off-by: Phillip Lougher <phillip@squashfs.org.uk> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> 
If Squashfs has been configured to directly read datablocks into the page
cache (SQUASHFS_FILE_DIRECT), then the read_page cache is unnecessary.

This improvement is due to the following two commits, which added the
ability to read datablocks into the page cache when pages were missing,
enabling the fallback which used an intermediate buffer to be removed.

commit f268eedddf359 ("squashfs: extend "page actor" to handle missing pages")
commit 1bb1a07afad97 ("squashfs: don't use intermediate buffer if pages missing")

This reduces the amount of memory used when mounting a filesystem by
block_size * maximum number of threads.

Link: https://lkml.kernel.org/r/20241229233752.54481-3-phillip@squashfs.org.uk
Signed-off-by: Phillip Lougher <phillip@squashfs.org.uk>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
squashfs: make squashfs_cache_init() return ERR_PTR(-ENOMEM) 2025-01-25T06:45:34+00:00 Phillip Lougher phillip@squashfs.org.uk 2024-12-29T23:37:49+00:00 49ff29240ebb13bc0efa4623d4379650e68fcb35 Patch series "squashfs: reduce memory usage and update docs". This patchset reduces the amount of memory that Squashfs uses when CONFIG_FILE_DIRECT is configured, and updates various out of date information in the documentation and Kconfig. This patch (of 4): Make squashfs_cache_init() return an ERR_PTR(-ENOMEM) on failure rather than NULL. This tidies up some calling code, but, it also allows NULL to be returned as a valid result when a cache hasn't be allocated. Link: https://lkml.kernel.org/r/20241229233752.54481-1-phillip@squashfs.org.uk Link: https://lkml.kernel.org/r/20241229233752.54481-2-phillip@squashfs.org.uk Signed-off-by: Phillip Lougher <phillip@squashfs.org.uk> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> 
Patch series "squashfs: reduce memory usage and update docs".

This patchset reduces the amount of memory that Squashfs uses when
CONFIG_FILE_DIRECT is configured, and updates various out of date
information in the documentation and Kconfig.

This patch (of 4):

Make squashfs_cache_init() return an ERR_PTR(-ENOMEM) on failure rather
than NULL.

This tidies up some calling code, but, it also allows NULL to be returned
as a valid result when a cache hasn't be allocated.

Link: https://lkml.kernel.org/r/20241229233752.54481-1-phillip@squashfs.org.uk
Link: https://lkml.kernel.org/r/20241229233752.54481-2-phillip@squashfs.org.uk
Signed-off-by: Phillip Lougher <phillip@squashfs.org.uk>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Squashfs: don't allocate fragment caches more than fragments 2025-01-13T04:21:08+00:00 pangliyuan pangliyuan1@huawei.com 2024-12-10T09:08:42+00:00 78188dd1d24b9d4cd78431feaa13120cfa37ca6a Sometimes the actual number of fragments in image is between 0 and SQUASHFS_CACHED_FRAGMENTS, which cause additional fragment caches to be allocated. Sets the number of fragment caches to the minimum of fragments and SQUASHFS_CACHED_FRAGMENTS. Link: https://lkml.kernel.org/r/20241210090842.160853-1-pangliyuan1@huawei.com Signed-off-by: pangliyuan <pangliyuan1@huawei.com> Reviewed-by: Phillip Lougher <phillip@squashfs.org.uk> Cc: <wangfangpeng1@huawei.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> 
Sometimes the actual number of fragments in image is between
0 and SQUASHFS_CACHED_FRAGMENTS, which cause additional
fragment caches to be allocated.

Sets the number of fragment caches to the minimum of fragments
and SQUASHFS_CACHED_FRAGMENTS.

Link: https://lkml.kernel.org/r/20241210090842.160853-1-pangliyuan1@huawei.com
Signed-off-by: pangliyuan <pangliyuan1@huawei.com>
Reviewed-by: Phillip Lougher <phillip@squashfs.org.uk>
Cc: <wangfangpeng1@huawei.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>