erofs: fix erofs_insert_workgroup() lockref usage

As Linus pointed out [1], lockref_put_return() is fundamentally
designed to be something that can fail.  It behaves as a fastpath-only
thing, and the failure case needs to be handled anyway.

Actually, since the new pcluster was just allocated without being
populated, it won't be accessed by others until it is inserted into
XArray, so lockref helpers are actually unneeded here.

Let's just set the proper reference count on initializing.

[1] https://lore.kernel.org/r/CAHk-=whCga8BeQnJ3ZBh_Hfm9ctba_wpF444LpwRybVNMzO6Dw@mail.gmail.com

Fixes: 7674a42f35ea ("erofs: use struct lockref to replace handcrafted approach")
Reviewed-by: Chao Yu <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
Signed-off-by: Gao Xiang <[email protected]>

diff --git a/fs/erofs/utils.c b/fs/erofs/utils.c
index cc6fb9e98899174662a77bca865846d1884e726b..4256a85719a1d25fbe3f0aa33820fafe3ad01d45 100644 (file)
--- a/fs/erofs/utils.c
+++ b/fs/erofs/utils.c
@@ -77,12 +77,7 @@ struct erofs_workgroup *erofs_insert_workgroup(struct super_block *sb,
        struct erofs_sb_info *const sbi = EROFS_SB(sb);
        struct erofs_workgroup *pre;
 
-       /*
-        * Bump up before making this visible to others for the XArray in order
-        * to avoid potential UAF without serialized by xa_lock.
-        */
-       lockref_get(&grp->lockref);
-
+       DBG_BUGON(grp->lockref.count < 1);
 repeat:
        xa_lock(&sbi->managed_pslots);
        pre = __xa_cmpxchg(&sbi->managed_pslots, grp->index,
@@ -96,7 +91,6 @@ repeat:
                        cond_resched();
                        goto repeat;
                }
-               lockref_put_return(&grp->lockref);
                grp = pre;
        }
        xa_unlock(&sbi->managed_pslots);

diff --git a/fs/erofs/zdata.c b/fs/erofs/zdata.c
index 036f610e044b60fa45ae696f8a3277ef85cf40b6..a7e6847f6f8f18f65ede10f6f7bc400e770cea04 100644 (file)
--- a/fs/erofs/zdata.c
+++ b/fs/erofs/zdata.c
@@ -796,6 +796,7 @@ static int z_erofs_register_pcluster(struct z_erofs_decompress_frontend *fe)
                return PTR_ERR(pcl);
 
        spin_lock_init(&pcl->obj.lockref.lock);
+       pcl->obj.lockref.count = 1;     /* one ref for this request */
        pcl->algorithmformat = map->m_algorithmformat;
        pcl->length = 0;
        pcl->partial = true;