From nobody Sun Dec 28 02:07:23 2025 Received: from out30-101.freemail.mail.aliyun.com (out30-101.freemail.mail.aliyun.com [115.124.30.101]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 3AA4A3C24 for ; Wed, 27 Dec 2023 05:06:47 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.alibaba.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.alibaba.com X-Alimail-AntiSpam: AC=PASS;BC=-1|-1;BR=01201311R791e4;CH=green;DM=||false|;DS=||;FP=0|-1|-1|-1|0|-1|-1|-1;HT=ay29a033018045168;MF=hsiangkao@linux.alibaba.com;NM=1;PH=DS;RN=6;SR=0;TI=SMTPD_---0VzJx.pC_1703653594; Received: from e69b19392.et15sqa.tbsite.net(mailfrom:hsiangkao@linux.alibaba.com fp:SMTPD_---0VzJx.pC_1703653594) by smtp.aliyun-inc.com; Wed, 27 Dec 2023 13:06:39 +0800 From: Gao Xiang To: linux-erofs@lists.ozlabs.org, Yue Hu Cc: LKML , Chao Yu , Gao Xiang , bugreport@ubisectech.com Subject: [PATCH v2] erofs: fix inconsistent per-file compression format Date: Wed, 27 Dec 2023 13:06:33 +0800 Message-Id: <20231227050633.1507448-1-hsiangkao@linux.alibaba.com> X-Mailer: git-send-email 2.39.3 In-Reply-To: <20231227041718.1428868-1-hsiangkao@linux.alibaba.com> References: <20231227041718.1428868-1-hsiangkao@linux.alibaba.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" EROFS can select compression algorithms on a per-file basis, and each per-file compression algorithm needs to be marked in the on-disk superblock for initialization. However, syzkaller can generate inconsistent crafted images that use an unsupported algorithm for specific inodes; thus, an unexpected "BUG: kernel NULL pointer dereference" can be raised. Fix this by checking against `sbi->available_compr_algs` for each compressed inode. Incorrect !erofs_sb_has_compr_cfgs preset bitmap is now fixed together since it was harmless previously. Reported-by: Fixes: 14373711dd54 ("erofs: add on-disk compression configurations") Signed-off-by: Gao Xiang Reviewed-by: Yue Hu --- change since v1: - fix left-shift overflow (undefined behavior). fs/erofs/decompressor.c | 2 +- fs/erofs/zmap.c | 9 ++++++--- 2 files changed, 7 insertions(+), 4 deletions(-) diff --git a/fs/erofs/decompressor.c b/fs/erofs/decompressor.c index 021be5feb1bc..af98e88908ee 100644 --- a/fs/erofs/decompressor.c +++ b/fs/erofs/decompressor.c @@ -398,7 +398,7 @@ int z_erofs_parse_cfgs(struct super_block *sb, struct e= rofs_super_block *dsb) int size, ret =3D 0; =20 if (!erofs_sb_has_compr_cfgs(sbi)) { - sbi->available_compr_algs =3D Z_EROFS_COMPRESSION_LZ4; + sbi->available_compr_algs =3D 1 << Z_EROFS_COMPRESSION_LZ4; return z_erofs_load_lz4_config(sb, dsb, NULL, 0); } =20 diff --git a/fs/erofs/zmap.c b/fs/erofs/zmap.c index 7b55111fd533..6f10bc8bbb1c 100644 --- a/fs/erofs/zmap.c +++ b/fs/erofs/zmap.c @@ -578,6 +578,7 @@ static int z_erofs_fill_inode_lazy(struct inode *inode) { struct erofs_inode *const vi =3D EROFS_I(inode); struct super_block *const sb =3D inode->i_sb; + struct erofs_sb_info *sbi =3D EROFS_SB(sb); int err, headnr; erofs_off_t pos; struct erofs_buf buf =3D __EROFS_BUF_INITIALIZER; @@ -624,10 +625,12 @@ static int z_erofs_fill_inode_lazy(struct inode *inod= e) =20 headnr =3D 0; if (vi->z_algorithmtype[0] >=3D Z_EROFS_COMPRESSION_MAX || - vi->z_algorithmtype[++headnr] >=3D Z_EROFS_COMPRESSION_MAX) { - erofs_err(sb, "unknown HEAD%u format %u for nid %llu, please upgrade ker= nel", + !(sbi->available_compr_algs & (1 << vi->z_algorithmtype[0])) || + vi->z_algorithmtype[++headnr] >=3D Z_EROFS_COMPRESSION_MAX || + !(sbi->available_compr_algs & (1 << vi->z_algorithmtype[headnr]))) { + erofs_err(sb, "inconsistent HEAD%u algorithm format %u for nid %llu", headnr + 1, vi->z_algorithmtype[headnr], vi->nid); - err =3D -EOPNOTSUPP; + err =3D -EFSCORRUPTED; goto out_put_metabuf; } =20 --=20 2.39.3