diff options
| author | Gao Xiang <hsiangkao@linux.alibaba.com> | 2025-06-19 06:28:39 +0300 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2025-06-27 13:13:43 +0300 |
| commit | 9957279ce953e4dbaa8560a8b54e5dd6cc283983 (patch) | |
| tree | df44a02a00838f97dbba29e3ddf3966cbe64dbce | |
| parent | fde255cc76ed3ec4b58e409cf545342e25366a6c (diff) | |
| download | linux-9957279ce953e4dbaa8560a8b54e5dd6cc283983.tar.xz | |
erofs: refuse crafted out-of-file-range encoded extents
[ Upstream commit 7869738b6908eec7755818aaf6f3aa068b2f0e1b ]
Crafted encoded extents could record out-of-range `lstart`, which should
not happen in normal cases.
It caused an iomap_iter_done() complaint [1] reported by syzbot.
[1] https://lore.kernel.org/r/684cb499.a00a0220.c6bd7.0010.GAE@google.com
Fixes: 1d191b4ca51d ("erofs: implement encoded extent metadata")
Reported-and-tested-by: syzbot+d8f000c609f05f52d9b5@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=d8f000c609f05f52d9b5
Signed-off-by: Gao Xiang <hsiangkao@linux.alibaba.com>
Link: https://lore.kernel.org/r/20250619032839.2642193-1-hsiangkao@linux.alibaba.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
| -rw-r--r-- | fs/erofs/zmap.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/fs/erofs/zmap.c b/fs/erofs/zmap.c index 14ea47f954f5..6afcb054780d 100644 --- a/fs/erofs/zmap.c +++ b/fs/erofs/zmap.c @@ -597,6 +597,10 @@ static int z_erofs_map_blocks_ext(struct inode *inode, if (la > map->m_la) { r = mid; + if (la > lend) { + DBG_BUGON(1); + return -EFSCORRUPTED; + } lend = la; } else { l = mid + 1; |