From: Gao Xiang <hsiangkao@linux.alibaba.com>
To: linux-erofs@lists.ozlabs.org, Yue Hu <huyue2@coolpad.com>
Cc: Gao Xiang <hsiangkao@linux.alibaba.com>,
bugreport@ubisectech.com, LKML <linux-kernel@vger.kernel.org>
Subject: [PATCH] erofs: fix inconsistent per-file compression format
Date: Wed, 27 Dec 2023 12:17:18 +0800 [thread overview]
Message-ID: <20231227041718.1428868-1-hsiangkao@linux.alibaba.com> (raw)
In-Reply-To: <1affdad9-20f1-4fca-95af-237fda3df2b1.bugreport@ubisectech.com>
EROFS can select compression algorithms on a per-file basis, and each
per-file compression algorithm needs to be marked in the on-disk
superblock for initialization.
However, syzkaller can generate inconsistent crafted images that use
an unsupported algorithm for specific inodes; thus, an unexpected
"BUG: kernel NULL pointer dereference" can be raised.
Fix this by checking against `sbi->available_compr_algs` for each
compressed inode. Incorrect !erofs_sb_has_compr_cfgs preset bitmap
is now fixed together since it was harmless previously.
Reported-by: <bugreport@ubisectech.com>
Fixes: 14373711dd54 ("erofs: add on-disk compression configurations")
Signed-off-by: Gao Xiang <hsiangkao@linux.alibaba.com>
---
fs/erofs/decompressor.c | 2 +-
fs/erofs/zmap.c | 15 ++++++++-------
2 files changed, 9 insertions(+), 8 deletions(-)
diff --git a/fs/erofs/decompressor.c b/fs/erofs/decompressor.c
index 021be5feb1bc..af98e88908ee 100644
--- a/fs/erofs/decompressor.c
+++ b/fs/erofs/decompressor.c
@@ -398,7 +398,7 @@ int z_erofs_parse_cfgs(struct super_block *sb, struct erofs_super_block *dsb)
int size, ret = 0;
if (!erofs_sb_has_compr_cfgs(sbi)) {
- sbi->available_compr_algs = Z_EROFS_COMPRESSION_LZ4;
+ sbi->available_compr_algs = 1 << Z_EROFS_COMPRESSION_LZ4;
return z_erofs_load_lz4_config(sb, dsb, NULL, 0);
}
diff --git a/fs/erofs/zmap.c b/fs/erofs/zmap.c
index 7b55111fd533..d513f2cd7521 100644
--- a/fs/erofs/zmap.c
+++ b/fs/erofs/zmap.c
@@ -578,7 +578,8 @@ static int z_erofs_fill_inode_lazy(struct inode *inode)
{
struct erofs_inode *const vi = EROFS_I(inode);
struct super_block *const sb = inode->i_sb;
- int err, headnr;
+ struct erofs_sb_info *sbi = EROFS_SB(sb);
+ int err, nr;
erofs_off_t pos;
struct erofs_buf buf = __EROFS_BUF_INITIALIZER;
void *kaddr;
@@ -622,12 +623,12 @@ static int z_erofs_fill_inode_lazy(struct inode *inode)
vi->z_algorithmtype[0] = h->h_algorithmtype & 15;
vi->z_algorithmtype[1] = h->h_algorithmtype >> 4;
- headnr = 0;
- if (vi->z_algorithmtype[0] >= Z_EROFS_COMPRESSION_MAX ||
- vi->z_algorithmtype[++headnr] >= Z_EROFS_COMPRESSION_MAX) {
- erofs_err(sb, "unknown HEAD%u format %u for nid %llu, please upgrade kernel",
- headnr + 1, vi->z_algorithmtype[headnr], vi->nid);
- err = -EOPNOTSUPP;
+ nr = 0;
+ if (!(sbi->available_compr_algs & (1 << vi->z_algorithmtype[0])) ||
+ !(sbi->available_compr_algs & (1 << vi->z_algorithmtype[++nr]))) {
+ erofs_err(sb, "inconsistent HEAD%u algorithm format %u for nid %llu",
+ nr + 1, vi->z_algorithmtype[nr], vi->nid);
+ err = -EFSCORRUPTED;
goto out_put_metabuf;
}
--
2.39.3
next parent reply other threads:[~2023-12-27 4:17 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <1affdad9-20f1-4fca-95af-237fda3df2b1.bugreport@ubisectech.com>
2023-12-27 4:17 ` Gao Xiang [this message]
2023-12-27 5:06 ` [PATCH v2] erofs: fix inconsistent per-file compression format Gao Xiang
2023-12-28 2:00 ` Yue Hu
2024-01-13 15:06 ` [PATCH v3] " Gao Xiang
2024-01-14 7:18 ` Yue Hu
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20231227041718.1428868-1-hsiangkao@linux.alibaba.com \
--to=hsiangkao@linux.alibaba.com \
--cc=bugreport@ubisectech.com \
--cc=huyue2@coolpad.com \
--cc=linux-erofs@lists.ozlabs.org \
--cc=linux-kernel@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).