From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from out30-118.freemail.mail.aliyun.com (out30-118.freemail.mail.aliyun.com [115.124.30.118]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id AF504365A07; Mon, 23 Mar 2026 07:55:30 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=115.124.30.118 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1774252533; cv=none; b=Pw164N8aVQkV9lcD0E/8qAzAMh/ehDECfPvvtLLtxZND8S5jrMH6ppimQNeGs460io1SA41YXxwNbTG0VUbU4zbU12OHiSDbb2wtwmQx1+kv0sn7Lw9emB730TTgaoqBhQhMtUxgmQVBitErNTxf/muoCVTacsVa43rw1zrcdyg= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1774252533; c=relaxed/simple; bh=TTHo8jrPrlCmbmIyrYd6pXhgJGBq5VZzmriJqjg7z1c=; h=Message-ID:Date:MIME-Version:Subject:To:Cc:References:From: In-Reply-To:Content-Type; b=VpiauaLqoGpFliBm6Oz4fRxQYk/tLIhjial2Inzv6cwMGE+/OSGFERNjj3Ep9oK1thbAHTmWWhqNmAZQb5aPntNVZXW4/lJMxJpsvBZ9AhZ5iyfKbXVaxVMfbml8+Y9F/k3nc17s0jwjQjI63N1lo5nVqNoj8jf3GH8crDsIk9g= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.alibaba.com; spf=pass smtp.mailfrom=linux.alibaba.com; dkim=pass (1024-bit key) header.d=linux.alibaba.com header.i=@linux.alibaba.com header.b=ycjfbneb; arc=none smtp.client-ip=115.124.30.118 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.alibaba.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.alibaba.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux.alibaba.com header.i=@linux.alibaba.com header.b="ycjfbneb" DKIM-Signature:v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.alibaba.com; s=default; t=1774252521; h=Message-ID:Date:MIME-Version:Subject:To:From:Content-Type; bh=Ln27PU6iTQhPj8tFQuQHGkfOiUwIVWgP9XLp448zqaw=; b=ycjfbnebbd0ZD696QJhFXrqkxQqYQ+DDwsX6y++TU+jqxdvCXYo2rx/CWJOw8thQxEAdoZgPQArih6g0EQeWdjX/zNCkY1fZxfQaubYPBIFLhQSYvqNFyDkBjX2jDSOGOvGt76LCLdyEIYwwXwUnsrzF87a9px4PKVjF2rSlhV4= X-Alimail-AntiSpam:AC=PASS;BC=-1|-1;BR=01201311R251e4;CH=green;DM=||false|;DS=||;FP=0|-1|-1|-1|0|-1|-1|-1;HT=maildocker-contentspam033037009110;MF=hsiangkao@linux.alibaba.com;NM=1;PH=DS;RN=10;SR=0;TI=SMTPD_---0X.UhD8J_1774252520; Received: from 30.221.131.200(mailfrom:hsiangkao@linux.alibaba.com fp:SMTPD_---0X.UhD8J_1774252520 cluster:ay36) by smtp.aliyun-inc.com; Mon, 23 Mar 2026 15:55:21 +0800 Message-ID: Date: Mon, 23 Mar 2026 15:55:19 +0800 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: Re: [PATCH 6.1 0/1] erofs: Fix the slab-out-of-bounds in drop_buffers() To: Denis Arefev , stable@vger.kernel.org, Greg Kroah-Hartman Cc: Gao Xiang , Chao Yu , Yue Hu , Jeffle Xu , linux-erofs@lists.ozlabs.org, linux-kernel@vger.kernel.org, lvc-project@linuxtesting.org References: <20260323074809.4542-1-arefev@swemel.ru> From: Gao Xiang In-Reply-To: <20260323074809.4542-1-arefev@swemel.ru> Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit Hi Denis, On 2026/3/23 15:48, Denis Arefev wrote: > Syzbot reported that a KASAN slab-out-of-bounds bug was discovered in the drop_buffers() > function [1]. > > The root cause is that erofs_raw_access_aops does not define .release_folio and > .invalidate_folio. When using iomap-based operations, folio->private may contain > iomap-specific data rather than buffer_heads. Without special handlers, the kernel > may fall back to generic functions (e.g., drop_buffers), which incorrectly treat > folio->private as a list of buffer_head structures, leading to incorrect memory > interpretation and out-of-bounds access. > > This can be fixed by explicitly setting .release_folio and .invalidate_folio to > iomap_release_folio and iomap_invalidate_folio, respectively, but there is a > commit ce529cc25b184e93397b94a8a322128fc0095cbb in upstream that implicitly > fixes this bug. See my previous reply to the patch. Thanks, Gao Xiang > > Please commit it to the stable branch v6.1.y . > > [1] https://syzkaller.appspot.com/bug?id=c6aeabd0c4ad2466f63a274faf2a123103f8fbf7 > > Jingbo Xu (1): > erofs: enable large folios for iomap mode > > fs/erofs/data.c | 2 ++ > fs/erofs/inode.c | 2 ++ > 2 files changed, 4 insertions(+) >