From nobody Tue Aug 25 14:31:37 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 2F0DD3DEAC6 for ; Fri, 14 Aug 2026 07:00:43 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786690845; cv=none; b=VMZCf/jZ3TxyjPstiHXn0oBqowwRF10J6BjkVvg+mVpPUcfc+29MqMUszQRX3AW7VQxzAy2zu33YdNMIOlM4IWaf8X4FJz9tbnSAqkiWFfhHhwwNtQp+vt+3X09qQLC1jZonFF9Wj+9IqRrxZjwH8I5P55g7XHYmBmUto6hOzRY= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786690845; c=relaxed/simple; bh=bHGpHejZ/ZWaq9U9cvtShUhyOovTyji9S/dYBE7TOBs=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=j/1aaDEXK0RA6232UY5HML8XMXnnhJlBLnKkYcUkfu7RYkX9LGAWh8IjMW8RZ4BV+y+35m/3ZB0Aee4BEvXyilECaf0MiXe/dherewSFtG2E+wOtggQUZkwqSBhL9DIVnBMecBHclOnDNvIOnB4pu0ILKzdfLgPtmjH6HUlBqu0= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=HFArCfYA; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="HFArCfYA" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 8BA7B1F000E9; Fri, 14 Aug 2026 07:00:38 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1786690843; bh=DMchTTGVCMvOtRC0iT99gWsRNfqufDGghfJVlAoNEtg=; h=From:To:Cc:Subject:Date; b=HFArCfYAU0/QmoO7sKGAsGFjVG3YFtGlycZ7NYmd5DTOCcXx8jstHMbGpBPbrbCl4 6Hc2ZI20crRt/b5HRc7+nuAPIhg8AdMX7NIEUcSd6YIl0pCYuYKhupUE5ZMd5oraHp mxSoF72HQv81vYWNL8Rfg9t78aTpw+9b6HfmRN/3MUo8TRnQH8C73PJ240epWekLFp EhkXYHLaVdyt2SS7bp9xApi5MWbfg8guD1a+YAGFqkFRatgsta1irkT7xz3cK5kHQz nRKnCGvuWtupQLOdd7VUlRI/O1eSpRAnXS3Wl8uO1439Po/cNo2WgywYrUiroTQ82V OJznwytmcQ2Hw== From: Gao Xiang To: linux-erofs@lists.ozlabs.org Cc: LKML , Gao Xiang , Haiyang Huang Subject: [PATCH] erofs: fix interlaced ztailpacking pclusters Date: Fri, 14 Aug 2026 14:59:46 +0800 Message-ID: <20260814065946.78216-1-xiang@kernel.org> X-Mailer: git-send-email 2.47.3 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" On-disk sizes of interlaced pclusters should be block-aligned, and ztailpacking interlaced pclusters should be invalid at all. Currently, mkfs.erofs won't generate any interlaced pcluster with ztailpacking enabled, so this doesn't affect any existing valid filesystems. However, crafted images can contain invalid interlaced ztailpacking pclusters, resulting in an out-of-bounds read from a kmap'd page and copying irrelevant kernel memory into userspace-visible page cache. Reported-by: Haiyang Huang Closes: https://lore.kernel.org/r/20260806065253.1083865-1-huanghaiyang83@g= mail.com Fixes: fdffc091e6f9 ("erofs: support interlaced uncompressed data for compr= essed files") Signed-off-by: Gao Xiang Reviewed-by: Chao Yu --- fs/erofs/decompressor.c | 1 + fs/erofs/zmap.c | 3 ++- 2 files changed, 3 insertions(+), 1 deletion(-) diff --git a/fs/erofs/decompressor.c b/fs/erofs/decompressor.c index 3c54e95964c9..27caf4bebddc 100644 --- a/fs/erofs/decompressor.c +++ b/fs/erofs/decompressor.c @@ -299,6 +299,7 @@ static const char *z_erofs_transform_plain(struct z_ero= fs_decompress_req *rq, return ERR_PTR(-EOPNOTSUPP); if (rq->alg =3D=3D Z_EROFS_COMPRESSION_INTERLACED) { cur =3D bs - (rq->pageofs_out & (bs - 1)); + DBG_BUGON(rq->pageofs_in & (bs - 1)); pi =3D (rq->pageofs_in + rq->inputsize - cur) & ~PAGE_MASK; cur =3D min(cur, rq->outputsize); if (cur && rq->out[0]) { diff --git a/fs/erofs/zmap.c b/fs/erofs/zmap.c index 5811556a7b71..331a231dfe13 100644 --- a/fs/erofs/zmap.c +++ b/fs/erofs/zmap.c @@ -483,7 +483,8 @@ static int z_erofs_map_blocks_fo(struct inode *inode, } =20 if (m.headtype =3D=3D Z_EROFS_LCLUSTER_TYPE_PLAIN) { - if (vi->z_advise & Z_EROFS_ADVISE_INTERLACED_PCLUSTER) + if (vi->z_advise & Z_EROFS_ADVISE_INTERLACED_PCLUSTER && + !(map->m_flags & EROFS_MAP_META)) map->m_algorithmformat =3D Z_EROFS_COMPRESSION_INTERLACED; else map->m_algorithmformat =3D Z_EROFS_COMPRESSION_SHIFTED; --=20 2.47.3