From nobody Sun Dec 28 02:07:22 2025 Received: from out30-99.freemail.mail.aliyun.com (out30-99.freemail.mail.aliyun.com [115.124.30.99]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 4160D3C15 for ; Wed, 27 Dec 2023 04:17:27 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.alibaba.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.alibaba.com X-Alimail-AntiSpam: AC=PASS;BC=-1|-1;BR=01201311R211e4;CH=green;DM=||false|;DS=||;FP=0|-1|-1|-1|0|-1|-1|-1;HT=ay29a033018045192;MF=hsiangkao@linux.alibaba.com;NM=1;PH=DS;RN=6;SR=0;TI=SMTPD_---0VzJyGwp_1703650640; Received: from e69b19392.et15sqa.tbsite.net(mailfrom:hsiangkao@linux.alibaba.com fp:SMTPD_---0VzJyGwp_1703650640) by smtp.aliyun-inc.com; Wed, 27 Dec 2023 12:17:25 +0800 From: Gao Xiang To: linux-erofs@lists.ozlabs.org, Yue Hu Cc: LKML , Chao Yu , Gao Xiang , bugreport@ubisectech.com Subject: [PATCH] erofs: fix inconsistent per-file compression format Date: Wed, 27 Dec 2023 12:17:18 +0800 Message-Id: <20231227041718.1428868-1-hsiangkao@linux.alibaba.com> X-Mailer: git-send-email 2.39.3 In-Reply-To: <1affdad9-20f1-4fca-95af-237fda3df2b1.bugreport@ubisectech.com> References: <1affdad9-20f1-4fca-95af-237fda3df2b1.bugreport@ubisectech.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" EROFS can select compression algorithms on a per-file basis, and each per-file compression algorithm needs to be marked in the on-disk superblock for initialization. However, syzkaller can generate inconsistent crafted images that use an unsupported algorithm for specific inodes; thus, an unexpected "BUG: kernel NULL pointer dereference" can be raised. Fix this by checking against `sbi->available_compr_algs` for each compressed inode. Incorrect !erofs_sb_has_compr_cfgs preset bitmap is now fixed together since it was harmless previously. Reported-by: Fixes: 14373711dd54 ("erofs: add on-disk compression configurations") Signed-off-by: Gao Xiang --- fs/erofs/decompressor.c | 2 +- fs/erofs/zmap.c | 15 ++++++++------- 2 files changed, 9 insertions(+), 8 deletions(-) diff --git a/fs/erofs/decompressor.c b/fs/erofs/decompressor.c index 021be5feb1bc..af98e88908ee 100644 --- a/fs/erofs/decompressor.c +++ b/fs/erofs/decompressor.c @@ -398,7 +398,7 @@ int z_erofs_parse_cfgs(struct super_block *sb, struct e= rofs_super_block *dsb) int size, ret =3D 0; =20 if (!erofs_sb_has_compr_cfgs(sbi)) { - sbi->available_compr_algs =3D Z_EROFS_COMPRESSION_LZ4; + sbi->available_compr_algs =3D 1 << Z_EROFS_COMPRESSION_LZ4; return z_erofs_load_lz4_config(sb, dsb, NULL, 0); } =20 diff --git a/fs/erofs/zmap.c b/fs/erofs/zmap.c index 7b55111fd533..d513f2cd7521 100644 --- a/fs/erofs/zmap.c +++ b/fs/erofs/zmap.c @@ -578,7 +578,8 @@ static int z_erofs_fill_inode_lazy(struct inode *inode) { struct erofs_inode *const vi =3D EROFS_I(inode); struct super_block *const sb =3D inode->i_sb; - int err, headnr; + struct erofs_sb_info *sbi =3D EROFS_SB(sb); + int err, nr; erofs_off_t pos; struct erofs_buf buf =3D __EROFS_BUF_INITIALIZER; void *kaddr; @@ -622,12 +623,12 @@ static int z_erofs_fill_inode_lazy(struct inode *inod= e) vi->z_algorithmtype[0] =3D h->h_algorithmtype & 15; vi->z_algorithmtype[1] =3D h->h_algorithmtype >> 4; =20 - headnr =3D 0; - if (vi->z_algorithmtype[0] >=3D Z_EROFS_COMPRESSION_MAX || - vi->z_algorithmtype[++headnr] >=3D Z_EROFS_COMPRESSION_MAX) { - erofs_err(sb, "unknown HEAD%u format %u for nid %llu, please upgrade ker= nel", - headnr + 1, vi->z_algorithmtype[headnr], vi->nid); - err =3D -EOPNOTSUPP; + nr =3D 0; + if (!(sbi->available_compr_algs & (1 << vi->z_algorithmtype[0])) || + !(sbi->available_compr_algs & (1 << vi->z_algorithmtype[++nr]))) { + erofs_err(sb, "inconsistent HEAD%u algorithm format %u for nid %llu", + nr + 1, vi->z_algorithmtype[nr], vi->nid); + err =3D -EFSCORRUPTED; goto out_put_metabuf; } =20 --=20 2.39.3