[PATCH v2] fs: btrfs: fix zstd decompression of compressed inline extents

The kernel compresses an inline extent as a whole block:
run_delalloc_inline() calls btrfs_compress_bio(inode, 0, blocksize, ...),
so the data is zero-filled past EOF and the resulting zstd frame declares
a content size of one block. The extent item records the unaligned file
size though - __cow_file_range_inline() passes i_size down to
insert_inline_extent(), which stores it as ram_bytes.

btrfs_read_extent_inline() sizes its decompression buffer from ram_bytes,
so for a 1900-byte file the destination is 1900 bytes while the frame
decodes to 4096. Since commit 918adf8e0733 ("btrfs: Use U-Boot API for
decompression") btrfs decompresses through the common U-Boot helper,
which uses the one-shot zstd_decompress_dctx(). That API requires the
destination to cover the whole frame and fails with dstSize_tooSmall,
error 70, otherwise. The streaming ZSTD_decompressStream() path it
replaced stopped once the output buffer was full, so it never hit this.

The kernel side does not notice because fs/btrfs/zstd.c streams into its
own buffer and copies out at most destlen.

Allocate a full block for the decompression buffer and copy only
ram_bytes back to the caller. An inline extent never spans more than one
block, which bounds the allocation.

This shows up on RK3399 and ODROID-N2 as "zstd_decompress: failed to
decompress: 70" (armbian/build#9651, #10208), where it breaks fdt apply
on zstd-compressed overlays. Images built with mkfs.btrfs --rootdir
--compress zstd do not reproduce it, since btrfs-progs writes a frame
whose content size already equals ram_bytes. Only files written at
runtime through the kernel trip it.

Fixes: 918adf8e0733 ("btrfs: Use U-Boot API for decompression")
Signed-off-by: Cole Munz <[email protected]>
---
v2:
 - Move the fix into btrfs_read_extent_inline() and size the decompression
   buffer to a full block, as Qu suggested. decompress_zstd() is left alone=
.
 - Rewrite the commit message. The failing case is compressed inline
   extents, not sector-padded regular extents: Qu pointed out that
   ram_bytes is always block aligned for regular extents.
 - Drop the zstd_find_frame_compressed_size() input trimming from v1. The
   inline item length is already exact, so it was doing nothing.

v1: https://lore.kernel.org/u-boot/9acf406b5e73fa83001e1951e883143e2afb8b2d=
[email protected]/

 fs/btrfs/inode.c | 15 +++++++++++++--
 1 file changed, 13 insertions(+), 2 deletions(-)

diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
index 3998ffc2c819..53f1059e1ef8 100644
--- a/fs/btrfs/inode.c
+++ b/fs/btrfs/inode.c
@@ -362,9 +362,11 @@ int btrfs_read_extent_inline(struct btrfs_path *path,
 =09=09=09     struct btrfs_file_extent_item *fi, char *dest)
 {
 =09struct extent_buffer *leaf =3D path->nodes[0];
+=09struct btrfs_fs_info *fs_info =3D leaf->fs_info;
 =09int slot =3D path->slots[0];
 =09char *cbuf =3D NULL;
 =09char *dbuf =3D NULL;
+=09u32 dbuf_size;
 =09u32 csize;
 =09u32 dsize;
 =09int ret;
@@ -380,8 +382,17 @@ int btrfs_read_extent_inline(struct btrfs_path *path,
=20
 =09/* Compressed extent, prepare the compressed and data buffer */
 =09dsize =3D btrfs_file_extent_ram_bytes(leaf, fi);
+=09/*
+=09 * The kernel compresses an inline extent as a whole block, zero-fillin=
g
+=09 * the tail past EOF, so the stream can decompress to more than
+=09 * ram_bytes.  zstd's one-shot API rejects a destination that cannot
+=09 * hold the entire frame, so give the decompressor a full block and cop=
y
+=09 * only ram_bytes back out.  An inline extent never spans more than one
+=09 * block, which bounds the allocation.
+=09 */
+=09dbuf_size =3D max_t(u32, dsize, fs_info->sectorsize);
 =09cbuf =3D malloc(csize);
-=09dbuf =3D malloc(dsize);
+=09dbuf =3D malloc(dbuf_size);
 =09if (!cbuf || !dbuf) {
 =09=09ret =3D -ENOMEM;
 =09=09goto out;
@@ -389,7 +400,7 @@ int btrfs_read_extent_inline(struct btrfs_path *path,
 =09read_extent_buffer(leaf, cbuf, btrfs_file_extent_inline_start(fi),
 =09=09=09   csize);
 =09ret =3D btrfs_decompress(btrfs_file_extent_compression(leaf, fi),
-=09=09=09       cbuf, csize, dbuf, dsize);
+=09=09=09       cbuf, csize, dbuf, dbuf_size);
 =09if (ret < 0) {
 =09=09ret =3D -EIO;
 =09=09goto out;
--=20
2.55.0