From nobody Fri Oct 2 02:30:16 2026 Received: from mail-pj2-f4.google.com (mail-pj2-f4.google.com [74.125.227.132]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 6375878F2F for ; Thu, 6 Aug 2026 06:55:01 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=74.125.227.132 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785999302; cv=none; b=dME+ntC6dZAzM8vUisXS2leAjRirDknMrlRslbOCtR4oxQpEWAE+lO7+j6gUSA4Y6PAstk+Cl6z71Kcp5fBJ6QbqmHhcwQ/cXVKc6n89veIuF1xGKORZBr6Nyv+woHqgotMbSoJOnIUVks3YgdFz2IdhDtWzt3YDWDtYadGMhW4= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785999302; c=relaxed/simple; bh=zgGxT3SSOQ24bRUL2XXVVhCBJgNk6SJsnyd9GJ0KTEk=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=OE6sfOt8IU5ekLwoCdBrj/GBWSXA3lPefocVtIY1pBMOKNbjZEGQ+gJTK33Mce8q5L45rtbwxNF+KzrwU99ZMqKUrLC5ainp8Ht8Bvdlai1ouMBelRP5TMhhRWMR12O352U7l9RX1v6nS4/TKv0wy1lKxQglrr/N8lUxAyl3HVo= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=YJxQImRG; arc=none smtp.client-ip=74.125.227.132 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="YJxQImRG" Received: by mail-pj2-f4.google.com with SMTP id d9443c01a7336-2cabe9335f1so10136015ad.0 for ; Wed, 05 Aug 2026 23:55:01 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1785999301; x=1786604101; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=LHiVelN5mh9CVmWnGQoTnlP7xVCZ+d8Y4Ey2Z8wrXTE=; b=YJxQImRGhd8aRCFHmTM1Qdgy5q0grduSRh+S3B83EhfHkidCooiTf4LNzdudEJLkze ZCj43wXBpsSrYXXS/vPd+tXDEQ1/8tPDeBUfo2UPl5JhHWGXZjRFlGBnmITTc0tqPSlo ywNfUiY59QsipPcSdTC6mhje17n1p+m7FSU/rzATkPGP+zWY+TCDL2pmBqMIvEUNKYeT NhlpTjaYvBFOTyysE8jQNlGlW+xZ1xtk+OigwnP1IPtjDeKg5Lqusgd/dg2bJpxPAGTH S/hmzOQxggJlKKQvjHsRfU/RellxFt7FZ7dNEiSs6MVCz5Erm+gjMiEW23R91ZiR6rON mibg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1785999301; x=1786604101; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=LHiVelN5mh9CVmWnGQoTnlP7xVCZ+d8Y4Ey2Z8wrXTE=; b=N+v0ezUqapuovXUjLcZyXA6RjQWElOAdC9Kwo1++nFGFCOHbOs5PsVyi4+YWz/kenn oEIizU/tPN0xCeRDtTU9zWEDS9sPMeY3GQtSYMeMHyLPhDBxx4uEq0pDXdSnHIi1UCO5 mxNnpm+iCL2z+Nj80bunmz3W6NmmyGxYe2EHWa1Nqws5daX/jngeAvWjlijd6p/iFGtk P2LFLtZla359lW2qf3OukDfFs/EG6rwnfj/ilqqZwoJZl9usucMV/hymlEyz03A05L6y rsfQvhIR28iq+JGgDgsx329u6pv3pKk8cui5h8+b49e3u1yOo5CNV4WOmf8JylvuSXq9 h7vA== X-Forwarded-Encrypted: i=1; AHgh+RojYT+U2WeFatEJl5gsFyUPm/iZeLxcN88bCBFF0j83qudhvds3V0M8A/KbzSFPIUyMiffEGp41FfSzQUg=@vger.kernel.org X-Gm-Message-State: AOJu0Yx6dtxZZyH6FTvN6ChFkRw5rCQPYd8UFPG9dxdoKPNYo71Mxp7w kj+b9/vhcFoRF2gh1L/Ft0/9lJwhNNCBIdT3ukzNxOhu/RoHWKRV4QHo X-Gm-Gg: AR+sD13fpb5tuwxTXTtHm6kw4otwlmXUyFJ4cy3ebRU2NKWDf3Fy9ea7D0J20N2iCkn RXieb89iLE4FsVbVomFwY6z2eD/mr6m1tjmAdEDTe3oaP9+Oc+nB5TeXF325Jh9d8AEj5Msx7m/ UygaTQAu+WWZv1j8P+tQhWNL2sLJid9iKkFg2LFMa0PTgrnIrj1ATYimNs1x0TX49Xx9rDAfNYO Js2fwdgBbJm0GgUe4QjiSB+pt1WoENnWULmeZ1wvhRkAoJ42//UJ5JG6efMmdbbWukcTRbqwGb8 CEOJfxsmRLeniVBuvBZllGfIkkq9XzonQaKtD+oJlkg6lNFoC2f99stdccL20gxMunrvM9kqRVi 8Jyj+67xnfub7bTyjLF6HOwz9XtnXe6dQhG889N1NJAEDA/T3WL2MV4PbqJ3FA/pFwcGdfzSvVx dYQBkwR9GRi+CvGs4hkPzAZKKxP3f9cNpHFK1ggbcthnydLQgs6WL2W8rutpsH0J2Jk7ZAcZoHH gUjuA5BdGUHQaa81qgJJbZO7W9J X-Received: by 2002:a17:903:2392:b0:2d0:cc92:f7a3 with SMTP id d9443c01a7336-2d0cc930281mr137694955ad.2.1785999300646; Wed, 05 Aug 2026 23:55:00 -0700 (PDT) Received: from yde24-ubuntu ([39.155.246.150]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2d0a9f93657sm26417645ad.17.2026.08.05.23.54.56 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 05 Aug 2026 23:55:00 -0700 (PDT) From: Haiyang Huang To: xiang@kernel.org, chao@kernel.org Cc: linux-erofs@lists.ozlabs.org, linux-kernel@vger.kernel.org, stable@vger.kernel.org, Haiyang Huang Subject: [PATCH] erofs: fix out-of-bounds read in INTERLACED pi computation Date: Thu, 6 Aug 2026 14:52:52 +0800 Message-ID: <20260806065253.1083865-1-huanghaiyang83@gmail.com> X-Mailer: git-send-email 2.53.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" In z_erofs_transform_plain(), the page offset `pi` for the INTERLACED initial tail copy is computed using the unclamped value of `cur`: cur =3D bs - (rq->pageofs_out & (bs - 1)); pi =3D (rq->pageofs_in + rq->inputsize - cur) & ~PAGE_MASK; cur =3D min(cur, rq->outputsize); When cur > pageofs_in + inputsize (which is the common case for ztailpacking pclusters since pageofs_in + inputsize <=3D bs), the subtraction underflows in unsigned arithmetic. The subsequent & ~PAGE_MASK extracts a bogus intra-page offset, and the memcpy/ memmove reads up to inputsize bytes from past the kmap'd page boundary. Fix this by clamping cur before computing pi, so the subtraction uses the actual copy size rather than the raw block-alignment distance. Fixes: 1ca01520148a ("erofs: refine z_erofs_transform_plain() for sub-page = block support") Cc: stable@vger.kernel.org Assisted-by: Claude:claude-opus-4-6 Signed-off-by: Haiyang Huang --- fs/erofs/decompressor.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/erofs/decompressor.c b/fs/erofs/decompressor.c index 3c54e95964c9..9c65364ed002 100644 --- a/fs/erofs/decompressor.c +++ b/fs/erofs/decompressor.c @@ -299,8 +299,8 @@ static const char *z_erofs_transform_plain(struct z_ero= fs_decompress_req *rq, return ERR_PTR(-EOPNOTSUPP); if (rq->alg =3D=3D Z_EROFS_COMPRESSION_INTERLACED) { cur =3D bs - (rq->pageofs_out & (bs - 1)); - pi =3D (rq->pageofs_in + rq->inputsize - cur) & ~PAGE_MASK; cur =3D min(cur, rq->outputsize); + pi =3D (rq->pageofs_in + rq->inputsize - cur) & ~PAGE_MASK; if (cur && rq->out[0]) { kin =3D kmap_local_page(rq->in[nrpages_in - 1]); if (rq->out[0] =3D=3D rq->in[nrpages_in - 1]) --=20 2.53.0