[PATCH 6.1] erofs: Fix the slab-out-of-bounds in drop_buffers()

[PATCH 6.1] erofs: Fix the slab-out-of-bounds in drop_buffers()

[Denis Arefev]

No upstream commit exists for this patch.

Syzbot reported that a KASAN slab-out-of-bounds bug was discovered in
the drop_buffers() function [1].

The root cause is that erofs_raw_access_aops does not define .release_folio
and .invalidate_folio. When using iomap-based operations, folio->private
may contain iomap-specific data rather than buffer_heads. Without special
handlers, the kernel may fall back to generic functions (such as 
drop_buffers), which incorrectly treat folio->private as a list of
buffer_head structures, leading to incorrect memory interpretation and
out-of-bounds access.

Fix this by explicitly setting .release_folio and .invalidate_folio to the
values of iomap_release_folio and iomap_invalidate_folio, respectively.

[1] https://syzkaller.appspot.com/x/report.txt?x=12e5a142580000 

Fixes: 7479c505b4ab ("fs: Convert iomap_readpage to iomap_read_folio")
Reported-by: syzbot+5b886a2e03529dbcef81@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?id=c6aeabd0c4ad2466f63a274faf2a123103f8fbf7
Signed-off-by: Denis Arefev <arefev@swemel.ru>
---
 fs/erofs/data.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/fs/erofs/data.c b/fs/erofs/data.c
index 7b648bec61fd..302e824827fc 100644
--- a/fs/erofs/data.c
+++ b/fs/erofs/data.c
@@ -406,6 +406,8 @@ const struct address_space_operations erofs_raw_access_aops = {
 	.readahead = erofs_readahead,
 	.bmap = erofs_bmap,
 	.direct_IO = noop_direct_IO,
+	.release_folio = iomap_release_folio,
+	.invalidate_folio = iomap_invalidate_folio,
 };
 
 #ifdef CONFIG_FS_DAX
-- 
2.43.0

Re: [PATCH 6.1] erofs: Fix the slab-out-of-bounds in drop_buffers()

[Gao Xiang]

On 2026/3/23 16:52, Denis Arefev wrote:
> No upstream commit exists for this patch.

That is also strange, since people would ask why not submiting a patch
upstream, I think you still need to mention the upstream commit

ce529cc25b184e93397b94a8a322128fc0095cbb
("erofs: enable large folios for iomap mode").

also see another commit in linux 6.1 branch:
1ce9ebc96eda ("erofs: ensure that the post-EOF tails are all zeroed").

Thanks,
Gao Xiang

> 
> Syzbot reported that a KASAN slab-out-of-bounds bug was discovered in
> the drop_buffers() function [1].
> 
> The root cause is that erofs_raw_access_aops does not define .release_folio
> and .invalidate_folio. When using iomap-based operations, folio->private
> may contain iomap-specific data rather than buffer_heads. Without special
> handlers, the kernel may fall back to generic functions (such as
> drop_buffers), which incorrectly treat folio->private as a list of
> buffer_head structures, leading to incorrect memory interpretation and
> out-of-bounds access.
> 
> Fix this by explicitly setting .release_folio and .invalidate_folio to the
> values of iomap_release_folio and iomap_invalidate_folio, respectively.
> 
> [1] https://syzkaller.appspot.com/x/report.txt?x=12e5a142580000
> 
> Fixes: 7479c505b4ab ("fs: Convert iomap_readpage to iomap_read_folio")
> Reported-by: syzbot+5b886a2e03529dbcef81@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?id=c6aeabd0c4ad2466f63a274faf2a123103f8fbf7
> Signed-off-by: Denis Arefev <arefev@swemel.ru>
> ---
>   fs/erofs/data.c | 2 ++
>   1 file changed, 2 insertions(+)
> 
> diff --git a/fs/erofs/data.c b/fs/erofs/data.c
> index 7b648bec61fd..302e824827fc 100644
> --- a/fs/erofs/data.c
> +++ b/fs/erofs/data.c
> @@ -406,6 +406,8 @@ const struct address_space_operations erofs_raw_access_aops = {
>   	.readahead = erofs_readahead,
>   	.bmap = erofs_bmap,
>   	.direct_IO = noop_direct_IO,
> +	.release_folio = iomap_release_folio,
> +	.invalidate_folio = iomap_invalidate_folio,
>   };
>   
>   #ifdef CONFIG_FS_DAX