From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id EFB4E3BFE4D for ; Mon, 17 Aug 2026 08:07:08 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786954030; cv=none; b=btkDx6WXjJdDPFovbvHHpfhlywoqN32zxhz+zq2qnJlwP7xFE5yWtVbTuF4MmVoFiEcGo4T3c1MElf6zb4LpZiylAxK/N9CjDwKggMkxaY0vhilo9MogAXkY+gtXowUD9rlvr6vcKExOO3XeYugICem06MC5Sta3XDpuk+RLia0= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786954030; c=relaxed/simple; bh=XlVQe60jxn9jA3l7UD1yCTTJu2Y5JiQRjajvRNNE14w=; h=Message-ID:Date:MIME-Version:Cc:Subject:To:References:From: In-Reply-To:Content-Type; b=JPsvsQSNSQVPdCeEmLdtl5QwaDyv7HOilSF2Nq02ngqQozA2NSBiFiqaZhASF9pIrNepS5UhK1DLz2zpk3RTbLBT7g13DV3+5ewl2R4486UCb+tfO7BHygmAW+c6a7WJe8HRs8GtYjGE1mJzglcZu8CWMXVOw2khawnyTC+jb5A= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=V7XqmRoJ; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="V7XqmRoJ" Received: by smtp.kernel.org (Postfix) with ESMTPSA id B29DD1F00A3A; Mon, 17 Aug 2026 08:07:07 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1786954028; bh=Tr/5LvYwvDujY6pEpgDa6NZZi0gBHtP9G5OH9zKqslg=; h=Date:Cc:Subject:To:References:From:In-Reply-To; b=V7XqmRoJ7VJ32P/O+43p8Gh5zfbfK7ITqdtjb1P3gH+Ix3zAPR9X0tTATUXOPXp/N lsZYhRNa1tQpDnhi5j27vk6BIYaFh/G/Ul/3v/2dS13Xmy1H1QGCiJ2rzyYB09Ihgf vHkNgtYZq2SGoUiGwK7l6Cq0hCjttM2VYFB1L65qaPevgBda06xWWto093+pnUSR/1 1yXWUnKRtCS8eLB4IQchQGa3rEjtZubGxeKwwqz/g6Y2mEoTi4hRuJsYHqzrf2kze3 yPjSqrKOVOn3EvryrzrSwIFC4Z3zN6Hz2gpx+dgd/MSObVFK6JIaAjVSSG/zQ3ohpc 399ym3F599MEA== Message-ID: <966c109e-f9e8-4d26-9d65-292949b1118b@kernel.org> Date: Mon, 17 Aug 2026 16:07:05 +0800 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Cc: chao@kernel.org, LKML , Haiyang Huang Subject: Re: [PATCH] erofs: fix interlaced ztailpacking pclusters To: Gao Xiang , linux-erofs@lists.ozlabs.org References: <20260814065946.78216-1-xiang@kernel.org> Content-Language: en-US From: Chao Yu In-Reply-To: <20260814065946.78216-1-xiang@kernel.org> Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit On 8/14/26 14:59, Gao Xiang wrote: > On-disk sizes of interlaced pclusters should be block-aligned, and > ztailpacking interlaced pclusters should be invalid at all. > > Currently, mkfs.erofs won't generate any interlaced pcluster with > ztailpacking enabled, so this doesn't affect any existing valid > filesystems. > > However, crafted images can contain invalid interlaced ztailpacking > pclusters, resulting in an out-of-bounds read from a kmap'd page and > copying irrelevant kernel memory into userspace-visible page cache. Nitpick, if this can only happen in a fuzz case, we can add unlikely for !(map->m_flags & EROFS_MAP_META)? > > Reported-by: Haiyang Huang > Closes: https://lore.kernel.org/r/20260806065253.1083865-1-huanghaiyang83@gmail.com > Fixes: fdffc091e6f9 ("erofs: support interlaced uncompressed data for compressed files") > Signed-off-by: Gao Xiang Reviewed-by: Chao Yu Thanks,