From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 9054042AFA1 for ; Fri, 14 Aug 2026 08:15:29 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786695331; cv=none; b=vEkHnUXHMIvH07q1sR+BxkOzGsDiQjxveIHk9ITMDfWHlOOg3aULAYio1JIBUc0vem3y/S/AMMI0jrjGuaViSavLke7jw9sClkDOKnrid/ddVeY/0l1m1mgxs7RizSFJNWhtDooYOE4y2+ebaDyqR8FgrKLdumpzjPmUc2I56jM= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786695331; c=relaxed/simple; bh=2V34n5/bD8b84K4c7orKScH0Vgsh/dVRk362jbKt8T0=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=Jaryp6XlyVlSmwCIBH8F6VtEzncA9gry4rv//T4O8gn5o0h7JcXDuvMQ77Sh7fqBXoB8Xzn7BeqxZIlpf34mM7BTGtsk4TlvZBfIzMbhX9J4k09Vt2THrIITCE6/afwjjll5yfh2Of4tBd02oyWYRTw5K5DnwsBwaPc7XmLBkLQ= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=K1rmHYbL; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="K1rmHYbL" Received: by smtp.kernel.org (Postfix) with ESMTPSA id EA9ED1F000E9; Fri, 14 Aug 2026 08:15:27 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1786695328; bh=jckIxw0rkLhWWXhIRUjCuN+lX9WBmeMyUIC/hbpvBdI=; h=From:To:Cc:Subject:Date; b=K1rmHYbLa6hKygwV4D3FtKsmInhDmW04X+JojGwmzJM0bivmcaxp47TIvgtjD76tM 5Jqe9L25bzwmC+DAPTeG9ulYzuc61B1AzBGIV6GC+jHhSZms+2ynkN0LaX/sClOTwY XPt+fdpDayK+/O8cO6ULmuqOZsVm9zBv0eAv7kfphxtvQJDC7GjhWuuJIhxvZ2l97a 8dC513Y7W4U7PtBENfgxBAnfRDeNorj/ID0mLbsUuEVeDiJQv68b3tFaAy8Llta0n7 La0CJ6nRPvhgH5KL9lo0RACkAOw0/lbd4+JT1AKi4c7XQzV3sF6CR6PtGd6vcqkt8r YidHXggAxVcTw== From: Gao Xiang To: linux-erofs@lists.ozlabs.org Cc: LKML , Gao Xiang Subject: [PATCH] erofs: guard on-disk algorithm IDs against Z_EROFS_COMPRESSION_MAX Date: Fri, 14 Aug 2026 16:14:37 +0800 Message-ID: <20260814081437.86684-1-xiang@kernel.org> X-Mailer: git-send-email 2.47.3 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit All on-disk algorithm IDs should be validated against supported Z_EROFS_COMPRESSION_MAX. This includes a partial revert of a previous commit and also adds validation for encoded extents. Fixes: 131897c65e2b ("erofs: fix invalid algorithm for encoded extents") Signed-off-by: Gao Xiang --- fs/erofs/internal.h | 2 +- fs/erofs/zmap.c | 35 +++++++++++++++++++++-------------- 2 files changed, 22 insertions(+), 15 deletions(-) diff --git a/fs/erofs/internal.h b/fs/erofs/internal.h index 6de6e5a58e6b..9b7370f0f3df 100644 --- a/fs/erofs/internal.h +++ b/fs/erofs/internal.h @@ -267,7 +267,7 @@ struct erofs_inode { #ifdef CONFIG_EROFS_FS_ZIP struct { unsigned short z_advise; - unsigned char z_algorithmtype[2]; + unsigned char z_algofmt[2]; unsigned char z_lclusterbits; union { u64 z_tailextent_headlcn; diff --git a/fs/erofs/zmap.c b/fs/erofs/zmap.c index b5411b579fd9..b316a50efe38 100644 --- a/fs/erofs/zmap.c +++ b/fs/erofs/zmap.c @@ -488,10 +488,9 @@ static int z_erofs_map_blocks_fo(struct inode *inode, map->m_algorithmformat = Z_EROFS_COMPRESSION_INTERLACED; else map->m_algorithmformat = Z_EROFS_COMPRESSION_SHIFTED; - } else if (m.headtype == Z_EROFS_LCLUSTER_TYPE_HEAD2) { - map->m_algorithmformat = vi->z_algorithmtype[1]; } else { - map->m_algorithmformat = vi->z_algorithmtype[0]; + map->m_algorithmformat = + vi->z_algofmt[m.headtype == Z_EROFS_LCLUSTER_TYPE_HEAD2]; } if ((flags & EROFS_GET_BLOCKS_FIEMAP) || @@ -605,9 +604,14 @@ static int z_erofs_map_blocks_ext(struct inode *inode, if (map->m_plen & Z_EROFS_EXTENT_PLEN_PARTIAL) map->m_flags |= EROFS_MAP_PARTIAL_REF; map->m_plen &= Z_EROFS_EXTENT_PLEN_MASK; - if (fmt) - map->m_algorithmformat = fmt - 1; - else if (interlaced && !((map->m_pa | map->m_plen) & bmask)) + if (fmt) { + map->m_algorithmformat = --fmt; + if (fmt >= Z_EROFS_COMPRESSION_MAX) { + erofs_err(sb, "unknown algorithm %d @ pos %llu for nid %llu, please upgrade kernel", + fmt, map->m_la, vi->nid); + return -EOPNOTSUPP; + } + } else if (interlaced && !((map->m_pa | map->m_plen) & bmask)) map->m_algorithmformat = Z_EROFS_COMPRESSION_INTERLACED; else @@ -625,7 +629,7 @@ static int z_erofs_fill_inode(struct inode *inode, struct erofs_map_blocks *map) struct super_block *const sb = inode->i_sb; struct z_erofs_map_header *h; erofs_off_t pos; - int err = 0; + int err = 0, nr; if (test_bit(EROFS_I_Z_INITED_BIT, &vi->flags)) { /* @@ -668,12 +672,19 @@ static int z_erofs_fill_inode(struct inode *inode, struct erofs_map_blocks *map) goto done; } - vi->z_algorithmtype[0] = h->h_algorithmtype & 15; - vi->z_algorithmtype[1] = h->h_algorithmtype >> 4; if (vi->z_advise & Z_EROFS_ADVISE_FRAGMENT_PCLUSTER) vi->z_fragmentoff = le32_to_cpu(h->h_fragmentoff); else if (vi->z_advise & Z_EROFS_ADVISE_INLINE_PCLUSTER) vi->z_idata_size = le16_to_cpu(h->h_idata_size); + for (nr = 0; nr < 2; ++nr) { + vi->z_algofmt[nr] = (h->h_algorithmtype >> (4 * nr)) & 15; + if (vi->z_algofmt[nr] >= Z_EROFS_COMPRESSION_MAX) { + erofs_err(sb, "unknown HEAD%u format %u for nid %llu, please upgrade kernel", + nr + 1, vi->z_algofmt[nr], vi->nid); + err = -EOPNOTSUPP; + goto out_unlock; + } + } if (!erofs_sb_has_big_pcluster(EROFS_SB(sb)) && vi->z_advise & (Z_EROFS_ADVISE_BIG_PCLUSTER_1 | @@ -721,12 +732,8 @@ static int z_erofs_map_sanity_check(struct inode *inode, if (!(map->m_flags & EROFS_MAP_MAPPED)) return 0; - if (unlikely(map->m_algorithmformat >= Z_EROFS_COMPRESSION_RUNTIME_MAX)) { - erofs_err(inode->i_sb, "unknown algorithm %d @ pos %llu for nid %llu, please upgrade kernel", - map->m_algorithmformat, map->m_la, EROFS_I(inode)->nid); - return -EOPNOTSUPP; - } + DBG_BUGON(map->m_algorithmformat >= Z_EROFS_COMPRESSION_RUNTIME_MAX); if (map->m_algorithmformat < Z_EROFS_COMPRESSION_MAX) { if (!(sbi->available_compr_algs & BIT(map->m_algorithmformat))) { erofs_err(inode->i_sb, "inconsistent algorithmtype %u for nid %llu", -- 2.47.3