kernel/linux.git/fs/erofs/decompressor.c, branch v7.0.10

erofs: fix unsigned underflow in z_erofs_lz4_handle_overlap()

2026-05-07T04:14:13+00:00

commit 21e161de2dc660b1bb70ef5b156ab8e6e1cca3ab upstream. Some crafted images can have illegal (!partial_decoding && m_llen < m_plen) extents, and the LZ4 inplace decompression path can be wrongly hit, but it cannot handle (outpages < inpages) properly: "outpages - inpages" wraps to a large value and the subsequent rq->out[] access reads past the decompressed_pages array. However, such crafted cases can correctly result in a corruption report in the normal LZ4 non-inplace path. Let's add an additional check to fix this for backporting. Reproducible image (base64-encoded gzipped blob): H4sIAJGR12kCA+3SPUoDQRgG4MkmkkZk8QRbRFIIi9hbpEjrHQI5ghfwCN5BLCzTGtLbBI+g dilSJo1CnIm7GEXFxhT6PDDwfrs73/ywIQD/1ePD4r7Ou6ETsrq4mu7XcWfj++Pb58nJU/9i PNtbjhan04/9GtX4qVYc814WDqt6FaX5s+ZwXXeq52lndT6IuVvlblytLMvh4Gzwaf90nsvz 2DF/21+20T/ldgp5s1jXRaN4t/8izsy/OUB6e/Qa79r+JwAAAAAAAL52vQVuGQAAAP6+my1w ywAAAAAAAADwu14ATsEYtgBQAAA= $ mount -t erofs -o cache_strategy=disabled foo.erofs /mnt $ dd if=/mnt/data of=/dev/null bs=4096 count=1 Fixes: 598162d05080 ("erofs: support decompress big pcluster for lz4 backend") Reported-by: Yuhao Jiang Cc: stable@vger.kernel.org Signed-off-by: Junrui Luo Reviewed-by: Gao Xiang Signed-off-by: Gao Xiang Signed-off-by: Greg Kroah-Hartman

erofs: separate plain and compressed filesystems formally

2026-02-03T03:05:57+00:00

The EROFS on-disk format uses a tiny, plain metadata design that prioritizes performance and minimizes complex inconsistencies against common writable disk filesystems (almost all serious metadata inconsistency cannot happen in well-designed immutable filesystems like EROFS). EROFS deliberately avoids artificial design flaws to eliminate serious security risks from untrusted remote sources by design, although human-made implementation bugs can still happen sometimes. Currently, there is no strict check to prevent compressed inodes, especially LZ4-compressed inodes, from being read in plain filesystems. Starting with erofs-utils 1.0 and Linux 5.3, LZ4_0PADDING sb feature is automatically enabled for LZ4-compressed EROFS images to support in-place decompression. Furthermore, since Linux 5.4 LTS is no longer supported, we no longer need to handle ancient LZ4-compressed EROFS images generated by erofs-utils prior to 1.0. To formally distinguish different filesystem types for improved security: - Use the presence of LZ4_0PADDING or a non-zero `dsb->u1.lz4_max_distance` as a marker for compressed filesystems containing LZ4-compressed inodes only; - For other algorithms, use `dsb->u1.available_compr_algs` bitmap. Note: LZ4_0PADDING has been supported since Linux 5.4 (the first formal kernel version), so exposing it via sysfs is no longer necessary and is now deprecated (but remain it for five more years until 2031): `dsb->u1` has been strictly non-zero for all EROFS images containing compressed inodes starting with erofs-utils v1.3 and it is actually a much better marker for compressed filesystems. Signed-off-by: Gao Xiang

erofs: improve LZ4 error strings

2026-01-22T16:00:50+00:00

Just like what was done for other algorithms, let's propagate detailed error reasons for LZ4 instead of just -EFSCORRUPTED to users: "corrupted compressed data": the compressed data is malformed or destination buffer is not large enough "unexpected end of stream": the compressed stream ends normally, but without producing enough decompressed data. "compressed data start not found": can be returned by z_erofs_fixup_insize(). Reviewed-by: Chao Yu Signed-off-by: Gao Xiang

erofs: simplify the code using for_each_set_bit

2026-01-22T16:00:36+00:00

When mounting the EROFS file system, it is necessary to check the available compression algorithms. At this time, the for_each_set_bit function can be used to simplify the code logic. Signed-off-by: Yuwen Chen Reviewed-by: Gao Xiang Reviewed-by: Chao Yu Signed-off-by: Gao Xiang

erofs: enable error reporting for z_erofs_fixup_insize()

2025-11-30T15:49:32+00:00

Enable propagation of detailed errors to callers. Signed-off-by: Gao Xiang

erofs: enable error reporting for z_erofs_stream_switch_bufs()

2025-11-28T14:00:08+00:00

Enable propagation of detailed errors to callers. Signed-off-by: Gao Xiang

erofs: improve decompression error reporting

2025-11-28T14:00:07+00:00

Change the return type of decompress() from `int` to `const char *` to provide more informative error diagnostics: - A NULL return indicates successful decompression; - If IS_ERR(ptr) is true, the return value encodes a standard negative errno (e.g., -ENOMEM, -EOPNOTSUPP) identifying the specific error; - Otherwise, a non-NULL return points to a human-readable error string, and the corresponding error code should be treated as -EFSCORRUPTED. Signed-off-by: Gao Xiang

erofs: tidy up z_erofs_lz4_handle_overlap()

2025-11-28T13:59:51+00:00

- Add some useful comments to explain inplace I/Os and decompression; - Rearrange the code to get rid of one unnecessary goto. Reviewed-by: Chao Yu Signed-off-by: Gao Xiang

erofs: implement metadata compression

2025-07-24T11:43:31+00:00

Thanks to the meta buffer infrastructure, metadata-compressed inodes are just read from the metabox inode instead of the blockdevice (or backing file) inode. The same is true for shared extended attributes. When metadata compression is enabled, inode numbers are divided from on-disk NIDs because of non-LTS 32-bit application compatibility. Co-developed-by: Gao Xiang Signed-off-by: Bo Liu (OpenAnolis) Acked-by: Chao Yu Signed-off-by: Gao Xiang Link: https://lore.kernel.org/r/20250722003229.2121752-1-hsiangkao@linux.alibaba.com

erofs: address D-cache aliasing

2025-07-10T09:08:27+00:00

Flush the D-cache before unlocking folios for compressed inodes, as they are dirtied during decompression. Avoid calling flush_dcache_folio() on every CPU write, since it's more like playing whack-a-mole without real benefit. It has no impact on x86 and arm64/risc-v: on x86, flush_dcache_folio() is a no-op, and on arm64/risc-v, PG_dcache_clean (PG_arch_1) is clear for new page cache folios. However, certain ARM boards are affected, as reported. Fixes: 3883a79abd02 ("staging: erofs: introduce VLE decompression support") Closes: https://lore.kernel.org/r/c1e51e16-6cc6-49d0-a63e-4e9ff6c4dd53@pengutronix.de Closes: https://lore.kernel.org/r/38d43fae-1182-4155-9c5b-ffc7382d9917@siemens.com Tested-by: Jan Kiszka Tested-by: Stefan Kerkmann Signed-off-by: Gao Xiang Link: https://lore.kernel.org/r/20250709034614.2780117-2-hsiangkao@linux.alibaba.com