* [PATCH 6.6.y 1/2] erofs: avoid infinite loops due to corrupted subpage compact indexes
2026-10-08 19:08 [PATCH 6.6.y 0/2] erofs: backport CVE-2025-68251, CVE-2026-53015 Artem Dinaburg
@ 2026-10-08 19:08 ` Artem Dinaburg
2026-10-08 19:08 ` [PATCH 6.6.y 2/2] erofs: unify lcn as u64 for 32-bit platforms Artem Dinaburg
2026-10-09 17:09 ` [PATCH 6.6.y 0/2] erofs: backport CVE-2025-68251, CVE-2026-53015 Sasha Levin
2 siblings, 0 replies; 4+ messages in thread
From: Artem Dinaburg @ 2026-10-08 19:08 UTC (permalink / raw)
To: stable
Cc: Artem Dinaburg, Greg Kroah-Hartman, Sasha Levin, Gao Xiang,
Robert Morris, Hongbo Li, Gao Xiang, Chao Yu, Yue Hu, Jeffle Xu,
linux-erofs, linux-kernel, Yue Hu, Sandeep Dhavale, Hongbo Li,
Chunhai Guo
From: Gao Xiang <hsiangkao@linux.alibaba.com>
[ Upstream commit e13d315ae077bb7c3c6027cc292401bc0f4ec683 ]
Robert reported an infinite loop observed by two crafted images.
The root cause is that `clusterofs` can be larger than `lclustersize`
for !NONHEAD `lclusters` in corrupted subpage compact indexes, e.g.:
blocksize = lclustersize = 512 lcn = 6 clusterofs = 515
Move the corresponding check for full compress indexes to
`z_erofs_load_lcluster_from_disk()` to also cover subpage compact
compress indexes.
It also fixes the position of `m->type >= Z_EROFS_LCLUSTER_TYPE_MAX`
check, since it should be placed right after
`z_erofs_load_{compact,full}_lcluster()`.
[ Backport to 6.6.y: preserve the switch-based full/compact loader and
perform the type and cluster-offset validation after either loader
using z_logical_clusterbits. ]
Fixes: 8d2517aaeea3 ("erofs: fix up compacted indexes for block size < 4096")
Fixes: 1a5223c182fd ("erofs: do sanity check on m->type in z_erofs_load_compact_lcluster()")
Reported-by: Robert Morris <rtm@csail.mit.edu>
Closes: https://lore.kernel.org/r/35167.1760645886@localhost
Reviewed-by: Hongbo Li <lihongbo22@huawei.com>
Signed-off-by: Gao Xiang <hsiangkao@linux.alibaba.com>
Assisted-by: LLM
Signed-off-by: Artem Dinaburg <artem@trailofbits.com>
---
This is patch 1 of 2 in the ordered 6.6.y backport series.
This change addresses CVE-2025-68251. 6.6 validates clusterofs only in the
full-index loader, leaving corrupted subpage compact NONHEAD records able
to drive non-progressing lookback.
This needed a target-specific adjustment; I called it out in the bracketed
backport note above.
The fix is already present in 6.12.y, 6.18.y, and 7.2.y, but not in 6.6.y.
fs/erofs/zmap.c | 30 +++++++++++++++++++++++-------
1 file changed, 23 insertions(+), 7 deletions(-)
diff --git a/fs/erofs/zmap.c b/fs/erofs/zmap.c
index 76566c2cbf63..e53d5239f04d 100644
--- a/fs/erofs/zmap.c
+++ b/fs/erofs/zmap.c
@@ -67,10 +67,6 @@ static int z_erofs_load_full_lcluster(struct z_erofs_maprecorder *m,
if (advise & Z_EROFS_LI_PARTIAL_REF)
m->partialref = true;
m->clusterofs = le16_to_cpu(di->di_clusterofs);
- if (m->clusterofs >= 1 << vi->z_logical_clusterbits) {
- DBG_BUGON(1);
- return -EFSCORRUPTED;
- }
m->pblk = le32_to_cpu(di->di_u.blkaddr);
break;
default:
@@ -276,14 +272,34 @@ static int z_erofs_load_compact_lcluster(struct z_erofs_maprecorder *m,
static int z_erofs_load_lcluster_from_disk(struct z_erofs_maprecorder *m,
unsigned int lcn, bool lookahead)
{
- switch (EROFS_I(m->inode)->datalayout) {
+ struct erofs_inode *vi = EROFS_I(m->inode);
+ int err;
+
+ switch (vi->datalayout) {
case EROFS_INODE_COMPRESSED_FULL:
- return z_erofs_load_full_lcluster(m, lcn);
+ err = z_erofs_load_full_lcluster(m, lcn);
+ break;
case EROFS_INODE_COMPRESSED_COMPACT:
- return z_erofs_load_compact_lcluster(m, lcn, lookahead);
+ err = z_erofs_load_compact_lcluster(m, lcn, lookahead);
+ break;
default:
return -EINVAL;
}
+ if (err)
+ return err;
+
+ if (m->type >= Z_EROFS_LCLUSTER_TYPE_MAX) {
+ erofs_err(m->inode->i_sb, "unknown type %u @ lcn %u of nid %llu",
+ m->type, lcn, vi->nid);
+ DBG_BUGON(1);
+ return -EOPNOTSUPP;
+ }
+ if (m->type != Z_EROFS_LCLUSTER_TYPE_NONHEAD &&
+ m->clusterofs >= (1 << vi->z_logical_clusterbits)) {
+ DBG_BUGON(1);
+ return -EFSCORRUPTED;
+ }
+ return 0;
}
static int z_erofs_extent_lookback(struct z_erofs_maprecorder *m,
--
2.39.5
^ permalink raw reply [flat|nested] 4+ messages in thread* [PATCH 6.6.y 2/2] erofs: unify lcn as u64 for 32-bit platforms
2026-10-08 19:08 [PATCH 6.6.y 0/2] erofs: backport CVE-2025-68251, CVE-2026-53015 Artem Dinaburg
2026-10-08 19:08 ` [PATCH 6.6.y 1/2] erofs: avoid infinite loops due to corrupted subpage compact indexes Artem Dinaburg
@ 2026-10-08 19:08 ` Artem Dinaburg
2026-10-09 17:09 ` [PATCH 6.6.y 0/2] erofs: backport CVE-2025-68251, CVE-2026-53015 Sasha Levin
2 siblings, 0 replies; 4+ messages in thread
From: Artem Dinaburg @ 2026-10-08 19:08 UTC (permalink / raw)
To: stable
Cc: Artem Dinaburg, Greg Kroah-Hartman, Sasha Levin, Gao Xiang,
Gao Xiang, Chao Yu, Yue Hu, Jeffle Xu, linux-erofs, linux-kernel,
Yue Hu, Sandeep Dhavale, Hongbo Li, Chunhai Guo
From: Gao Xiang <hsiangkao@linux.alibaba.com>
[ Upstream commit 2d8c7edcb661812249469f4a5b62e9339118846f ]
As sashiko reported [1], `lcn` was typed as `unsigned long` (or
`unsigned int` sometimes), which is only 32 bits wide on 32-bit
platforms, which causes `(lcn << lclusterbits)` to be truncated
at 4 GiB.
In order to consolidate the logic, just use `u64` consistently
around the codebase.
[1] https://sashiko.dev/r/20260420034612.1899973-1-hsiangkao%40linux.alibaba.com
[ Backport to 6.6.y: rebase after the CVE-2025-68251 compact-index
validation change. Widen its new lcn diagnostic along with the
recorder, full and compact loader data flow, lookback and compressed-
length locals to u64. ]
Fixes: 152a333a5895 ("staging: erofs: add compacted compression indexes support")
Signed-off-by: Gao Xiang <hsiangkao@linux.alibaba.com>
Assisted-by: LLM
Signed-off-by: Artem Dinaburg <artem@trailofbits.com>
---
This is patch 2 of 2 in the ordered 6.6.y backport series.
This change addresses CVE-2026-53015. The EROFS zmap implementation and the
preceding compact-index validation fix otherwise retain 32-bit lcn values
in shifts on 32-bit systems; widening the complete data flow and the
validation diagnostic to u64 prevents 4-GiB truncation without weakening
the new loop check.
This needed a target-specific adjustment; I called it out in the bracketed
backport note above.
The fix is absent from the pinned 6.6.y branch and queue and must follow
CVE-2025-68251 in this series.
fs/erofs/zmap.c | 23 +++++++++++------------
1 file changed, 11 insertions(+), 12 deletions(-)
diff --git a/fs/erofs/zmap.c b/fs/erofs/zmap.c
index e53d5239f04d..990322b228cb 100644
--- a/fs/erofs/zmap.c
+++ b/fs/erofs/zmap.c
@@ -12,7 +12,7 @@ struct z_erofs_maprecorder {
struct erofs_map_blocks *map;
void *kaddr;
- unsigned long lcn;
+ u64 lcn;
/* compression extent information gathered */
u8 type, headtype;
u16 clusterofs;
@@ -22,8 +22,7 @@ struct z_erofs_maprecorder {
bool partialref;
};
-static int z_erofs_load_full_lcluster(struct z_erofs_maprecorder *m,
- unsigned long lcn)
+static int z_erofs_load_full_lcluster(struct z_erofs_maprecorder *m, u64 lcn)
{
struct inode *const inode = m->inode;
struct erofs_inode *const vi = EROFS_I(inode);
@@ -219,7 +218,7 @@ static int unpack_compacted_index(struct z_erofs_maprecorder *m,
}
static int z_erofs_load_compact_lcluster(struct z_erofs_maprecorder *m,
- unsigned long lcn, bool lookahead)
+ u64 lcn, bool lookahead)
{
struct inode *const inode = m->inode;
struct erofs_inode *const vi = EROFS_I(inode);
@@ -270,7 +269,7 @@ static int z_erofs_load_compact_lcluster(struct z_erofs_maprecorder *m,
}
static int z_erofs_load_lcluster_from_disk(struct z_erofs_maprecorder *m,
- unsigned int lcn, bool lookahead)
+ u64 lcn, bool lookahead)
{
struct erofs_inode *vi = EROFS_I(m->inode);
int err;
@@ -289,7 +288,7 @@ static int z_erofs_load_lcluster_from_disk(struct z_erofs_maprecorder *m,
return err;
if (m->type >= Z_EROFS_LCLUSTER_TYPE_MAX) {
- erofs_err(m->inode->i_sb, "unknown type %u @ lcn %u of nid %llu",
+ erofs_err(m->inode->i_sb, "unknown type %u @ lcn %llu of nid %llu",
m->type, lcn, vi->nid);
DBG_BUGON(1);
return -EOPNOTSUPP;
@@ -310,7 +309,7 @@ static int z_erofs_extent_lookback(struct z_erofs_maprecorder *m,
const unsigned int lclusterbits = vi->z_logical_clusterbits;
while (m->lcn >= lookback_distance) {
- unsigned long lcn = m->lcn - lookback_distance;
+ u64 lcn = m->lcn - lookback_distance;
int err;
err = z_erofs_load_lcluster_from_disk(m, lcn, false);
@@ -330,14 +329,14 @@ static int z_erofs_extent_lookback(struct z_erofs_maprecorder *m,
m->map->m_la = (lcn << lclusterbits) | m->clusterofs;
return 0;
default:
- erofs_err(sb, "unknown type %u @ lcn %lu of nid %llu",
+ erofs_err(sb, "unknown type %u @ lcn %llu of nid %llu",
m->type, lcn, vi->nid);
DBG_BUGON(1);
return -EOPNOTSUPP;
}
}
err_bogus:
- erofs_err(sb, "bogus lookback distance %u @ lcn %lu of nid %llu",
+ erofs_err(sb, "bogus lookback distance %u @ lcn %llu of nid %llu",
lookback_distance, m->lcn, vi->nid);
DBG_BUGON(1);
return -EFSCORRUPTED;
@@ -350,7 +349,7 @@ static int z_erofs_get_extent_compressedlen(struct z_erofs_maprecorder *m,
struct erofs_inode *const vi = EROFS_I(m->inode);
struct erofs_map_blocks *const map = m->map;
const unsigned int lclusterbits = vi->z_logical_clusterbits;
- unsigned long lcn;
+ u64 lcn;
int err;
DBG_BUGON(m->type != Z_EROFS_LCLUSTER_TYPE_PLAIN &&
@@ -402,7 +401,7 @@ static int z_erofs_get_extent_compressedlen(struct z_erofs_maprecorder *m,
break;
fallthrough;
default:
- erofs_err(sb, "cannot found CBLKCNT @ lcn %lu of nid %llu", lcn,
+ erofs_err(sb, "cannot found CBLKCNT @ lcn %llu of nid %llu", lcn,
vi->nid);
DBG_BUGON(1);
return -EFSCORRUPTED;
@@ -411,7 +410,7 @@ static int z_erofs_get_extent_compressedlen(struct z_erofs_maprecorder *m,
map->m_plen = erofs_pos(sb, m->compressedblks);
return 0;
err_bonus_cblkcnt:
- erofs_err(sb, "bogus CBLKCNT @ lcn %lu of nid %llu", lcn, vi->nid);
+ erofs_err(sb, "bogus CBLKCNT @ lcn %llu of nid %llu", lcn, vi->nid);
DBG_BUGON(1);
return -EFSCORRUPTED;
}
--
2.39.5
^ permalink raw reply [flat|nested] 4+ messages in thread