From nobody Thu Dec 25 17:55:22 2025 Received: from out30-119.freemail.mail.aliyun.com (out30-119.freemail.mail.aliyun.com [115.124.30.119]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id C78CC360 for ; Sat, 13 Jan 2024 15:06:18 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.alibaba.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.alibaba.com X-Alimail-AntiSpam: AC=PASS;BC=-1|-1;BR=01201311R551e4;CH=green;DM=||false|;DS=||;FP=0|-1|-1|-1|0|-1|-1|-1;HT=ay29a033018046049;MF=hsiangkao@linux.alibaba.com;NM=1;PH=DS;RN=5;SR=0;TI=SMTPD_---0W-Vyax8_1705158364; Received: from e69b19392.et15sqa.tbsite.net(mailfrom:hsiangkao@linux.alibaba.com fp:SMTPD_---0W-Vyax8_1705158364) by smtp.aliyun-inc.com; Sat, 13 Jan 2024 23:06:10 +0800 From: Gao Xiang To: linux-erofs@lists.ozlabs.org, Yue Hu Cc: LKML , Gao Xiang , bugreport@ubisectech.com Subject: [PATCH v3] erofs: fix inconsistent per-file compression format Date: Sat, 13 Jan 2024 23:06:02 +0800 Message-Id: <20240113150602.1471050-1-hsiangkao@linux.alibaba.com> X-Mailer: git-send-email 2.39.3 In-Reply-To: <20231227050633.1507448-1-hsiangkao@linux.alibaba.com> References: <20231227050633.1507448-1-hsiangkao@linux.alibaba.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" EROFS can select compression algorithms on a per-file basis, and each per-file compression algorithm needs to be marked in the on-disk superblock for initialization. However, syzkaller can generate inconsistent crafted images that use an unsupported algorithmtype for specific inodes, e.g. use MicroLZMA algorithmtype even it's not set in `sbi->available_compr_algs`. This can lead to an unexpected "BUG: kernel NULL pointer dereference" if the corresponding decompressor isn't built-in. Fix this by checking against `sbi->available_compr_algs` for each m_algorithmformat request. Incorrect !erofs_sb_has_compr_cfgs preset bitmap is now fixed together since it was harmless previously. Reported-by: Fixes: 8f89926290c4 ("erofs: get compression algorithms directly on mapping= ") Fixes: 622ceaddb764 ("erofs: lzma compression support") Reviewed-by: Yue Hu Signed-off-by: Gao Xiang --- changes since v2: - Should check in z_erofs_do_map_blocks() runtimely since another algorithmtype[0/1] could leave as unused (0) but it can be problematic if LZ4 is not set in `sbi->available_compr_algs`. fs/erofs/decompressor.c | 2 +- fs/erofs/zmap.c | 23 +++++++++++++---------- 2 files changed, 14 insertions(+), 11 deletions(-) diff --git a/fs/erofs/decompressor.c b/fs/erofs/decompressor.c index 1d65b9f60a39..072ef6a66823 100644 --- a/fs/erofs/decompressor.c +++ b/fs/erofs/decompressor.c @@ -408,7 +408,7 @@ int z_erofs_parse_cfgs(struct super_block *sb, struct e= rofs_super_block *dsb) int size, ret =3D 0; =20 if (!erofs_sb_has_compr_cfgs(sbi)) { - sbi->available_compr_algs =3D Z_EROFS_COMPRESSION_LZ4; + sbi->available_compr_algs =3D 1 << Z_EROFS_COMPRESSION_LZ4; return z_erofs_load_lz4_config(sb, dsb, NULL, 0); } =20 diff --git a/fs/erofs/zmap.c b/fs/erofs/zmap.c index 9753875e41cb..7e1116804008 100644 --- a/fs/erofs/zmap.c +++ b/fs/erofs/zmap.c @@ -454,7 +454,7 @@ static int z_erofs_do_map_blocks(struct inode *inode, .map =3D map, }; int err =3D 0; - unsigned int lclusterbits, endoff; + unsigned int lclusterbits, endoff, afmt; unsigned long initial_lcn; unsigned long long ofs, end; =20 @@ -543,17 +543,20 @@ static int z_erofs_do_map_blocks(struct inode *inode, err =3D -EFSCORRUPTED; goto unmap_out; } - if (vi->z_advise & Z_EROFS_ADVISE_INTERLACED_PCLUSTER) - map->m_algorithmformat =3D - Z_EROFS_COMPRESSION_INTERLACED; - else - map->m_algorithmformat =3D - Z_EROFS_COMPRESSION_SHIFTED; - } else if (m.headtype =3D=3D Z_EROFS_LCLUSTER_TYPE_HEAD2) { - map->m_algorithmformat =3D vi->z_algorithmtype[1]; + afmt =3D vi->z_advise & Z_EROFS_ADVISE_INTERLACED_PCLUSTER ? + Z_EROFS_COMPRESSION_INTERLACED : + Z_EROFS_COMPRESSION_SHIFTED; } else { - map->m_algorithmformat =3D vi->z_algorithmtype[0]; + afmt =3D m.headtype =3D=3D Z_EROFS_LCLUSTER_TYPE_HEAD2 ? + vi->z_algorithmtype[1] : vi->z_algorithmtype[0]; + if (!(EROFS_I_SB(inode)->available_compr_algs & (1 << afmt))) { + erofs_err(inode->i_sb, "inconsistent algorithmtype %u for nid %llu", + afmt, vi->nid); + err =3D -EFSCORRUPTED; + goto unmap_out; + } } + map->m_algorithmformat =3D afmt; =20 if ((flags & EROFS_GET_BLOCKS_FIEMAP) || ((flags & EROFS_GET_BLOCKS_READMORE) && --=20 2.39.3