[PATCH] erofs: fix out-of-bounds read in INTERLACED pi computation

[PATCH] erofs: fix out-of-bounds read in INTERLACED pi computation

[Haiyang Huang]

In z_erofs_transform_plain(), the page offset `pi` for the INTERLACED
initial tail copy is computed using the unclamped value of `cur`:

    cur = bs - (rq->pageofs_out & (bs - 1));
    pi = (rq->pageofs_in + rq->inputsize - cur) & ~PAGE_MASK;
    cur = min(cur, rq->outputsize);

When cur > pageofs_in + inputsize (which is the common case for
ztailpacking pclusters since pageofs_in + inputsize <= bs), the
subtraction underflows in unsigned arithmetic. The subsequent
& ~PAGE_MASK extracts a bogus intra-page offset, and the memcpy/
memmove reads up to inputsize bytes from past the kmap'd page boundary.

Fix this by clamping cur before computing pi, so the subtraction uses
the actual copy size rather than the raw block-alignment distance.

Fixes: 1ca01520148a ("erofs: refine z_erofs_transform_plain() for sub-page block support")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-4-6
Signed-off-by: Haiyang Huang <huanghaiyang83@gmail.com>
---
 fs/erofs/decompressor.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/erofs/decompressor.c b/fs/erofs/decompressor.c
index 3c54e95964c9..9c65364ed002 100644
--- a/fs/erofs/decompressor.c
+++ b/fs/erofs/decompressor.c
@@ -299,8 +299,8 @@ static const char *z_erofs_transform_plain(struct z_erofs_decompress_req *rq,
 		return ERR_PTR(-EOPNOTSUPP);
 	if (rq->alg == Z_EROFS_COMPRESSION_INTERLACED) {
 		cur = bs - (rq->pageofs_out & (bs - 1));
-		pi = (rq->pageofs_in + rq->inputsize - cur) & ~PAGE_MASK;
 		cur = min(cur, rq->outputsize);
+		pi = (rq->pageofs_in + rq->inputsize - cur) & ~PAGE_MASK;
 		if (cur && rq->out[0]) {
 			kin = kmap_local_page(rq->in[nrpages_in - 1]);
 			if (rq->out[0] == rq->in[nrpages_in - 1])
-- 
2.53.0