From patchwork Wed Dec 27 04:17:18 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Gao Xiang X-Patchwork-Id: 183407 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a05:7301:6f82:b0:100:9c79:88ff with SMTP id tb2csp1236311dyb; Tue, 26 Dec 2023 20:17:58 -0800 (PST) X-Google-Smtp-Source: AGHT+IGQLmQhsTAolRQIGPSSpneSu8OPMLk4fZrF6pWHb4teqM82vg1hZxKGLFLTvXV8w8EBMb17 X-Received: by 2002:a05:6a21:7892:b0:195:d5a5:da02 with SMTP id bf18-20020a056a21789200b00195d5a5da02mr3438337pzc.9.1703650677798; Tue, 26 Dec 2023 20:17:57 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1703650677; cv=none; d=google.com; s=arc-20160816; b=XnKCyP9HxFTldNhSD1O62xqCfHVryx9sc5Md+0kxbCHrGJ+6ljcLdA2zapf7tG9dqC WQaXed8URCUKWC0jNUCv7tjZvryx0J8vd1hb9VnWPv9Qc4RceRMyUdD32EJkxaDgcav/ 5Ht9rGXt4icOYUwpCz/5YjpZqpgcpQ3vqaGJDXuPsYc4GmFbZOZHUBjKeJnjyfWqgx/F Wvm+Es+V0mSTXvz1r8ocg1tE/E/WiMszpRGq0F0Oj3U8pBZeU329ICdr+pfMKa/ELEM9 uKxqEnJpmR9sAy0a7Qcsgh5pgySaPVwuPeW+uJBqzt9es3RbOJzmU0hXb8qpWqC1VstW TrZA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=content-transfer-encoding:mime-version:list-unsubscribe :list-subscribe:list-id:precedence:references:in-reply-to:message-id :date:subject:cc:to:from; bh=KEyvBG9guI/ijSBI61Zrai1RT6rFl5qFBlZJhomEVEc=; fh=bnrnBcbyx0sM9DAnoHOQn6e7uer82WeSGox/oq7y2Ak=; b=AsD2M91u/fOGLNjgwrxS7nJ+ElqE1pUSGghi+1BkZr7DxEF5ocDzfeecrKjIwXXv7E CUePl29QmTzk1Q/phxlDLUWQ68bYavKgvSnaIfrQsoi/4PLgtKzskX50GAtfba8myj3R e+UeRQAD/55TILPvM7XXmfANB2wW6Ez4/i59PZXTtPvtVgXFnPTo3atj1gL/atPiAziZ ydi6nO1JNoazjWpFbm//TudTfvWQmzsjo9u80nIrz+VqbHnwLHELJHBzUiIoBO/zNL18 TQAABpPq42kweg9o8CF18xoaywkOr4uEtXae3L/u43ScY8cW4rYCGx0vOmVJDjWTlwXL CLqw== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of linux-kernel+bounces-11815-ouuuleilei=gmail.com@vger.kernel.org designates 147.75.48.161 as permitted sender) smtp.mailfrom="linux-kernel+bounces-11815-ouuuleilei=gmail.com@vger.kernel.org"; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=alibaba.com Received: from sy.mirrors.kernel.org (sy.mirrors.kernel.org. [147.75.48.161]) by mx.google.com with ESMTPS id l18-20020a62be12000000b006d98b960149si8087932pff.347.2023.12.26.20.17.57 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 26 Dec 2023 20:17:57 -0800 (PST) Received-SPF: pass (google.com: domain of linux-kernel+bounces-11815-ouuuleilei=gmail.com@vger.kernel.org designates 147.75.48.161 as permitted sender) client-ip=147.75.48.161; Authentication-Results: mx.google.com; spf=pass (google.com: domain of linux-kernel+bounces-11815-ouuuleilei=gmail.com@vger.kernel.org designates 147.75.48.161 as permitted sender) smtp.mailfrom="linux-kernel+bounces-11815-ouuuleilei=gmail.com@vger.kernel.org"; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=alibaba.com Received: from smtp.subspace.kernel.org (wormhole.subspace.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by sy.mirrors.kernel.org (Postfix) with ESMTPS id 37430B224CC for ; Wed, 27 Dec 2023 04:17:46 +0000 (UTC) Received: from localhost.localdomain (localhost.localdomain [127.0.0.1]) by smtp.subspace.kernel.org (Postfix) with ESMTP id 69594442F; Wed, 27 Dec 2023 04:17:32 +0000 (UTC) X-Original-To: linux-kernel@vger.kernel.org Received: from out30-99.freemail.mail.aliyun.com (out30-99.freemail.mail.aliyun.com [115.124.30.99]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 4160D3C15 for ; Wed, 27 Dec 2023 04:17:27 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.alibaba.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.alibaba.com X-Alimail-AntiSpam: AC=PASS;BC=-1|-1;BR=01201311R211e4;CH=green;DM=||false|;DS=||;FP=0|-1|-1|-1|0|-1|-1|-1;HT=ay29a033018045192;MF=hsiangkao@linux.alibaba.com;NM=1;PH=DS;RN=6;SR=0;TI=SMTPD_---0VzJyGwp_1703650640; Received: from e69b19392.et15sqa.tbsite.net(mailfrom:hsiangkao@linux.alibaba.com fp:SMTPD_---0VzJyGwp_1703650640) by smtp.aliyun-inc.com; Wed, 27 Dec 2023 12:17:25 +0800 From: Gao Xiang To: linux-erofs@lists.ozlabs.org, Yue Hu Cc: LKML , Chao Yu , Gao Xiang , bugreport@ubisectech.com Subject: [PATCH] erofs: fix inconsistent per-file compression format Date: Wed, 27 Dec 2023 12:17:18 +0800 Message-Id: <20231227041718.1428868-1-hsiangkao@linux.alibaba.com> X-Mailer: git-send-email 2.39.3 In-Reply-To: <1affdad9-20f1-4fca-95af-237fda3df2b1.bugreport@ubisectech.com> References: <1affdad9-20f1-4fca-95af-237fda3df2b1.bugreport@ubisectech.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-getmail-retrieved-from-mailbox: INBOX X-GMAIL-THRID: 1786407213098482187 X-GMAIL-MSGID: 1786407213098482187 EROFS can select compression algorithms on a per-file basis, and each per-file compression algorithm needs to be marked in the on-disk superblock for initialization. However, syzkaller can generate inconsistent crafted images that use an unsupported algorithm for specific inodes; thus, an unexpected "BUG: kernel NULL pointer dereference" can be raised. Fix this by checking against `sbi->available_compr_algs` for each compressed inode. Incorrect !erofs_sb_has_compr_cfgs preset bitmap is now fixed together since it was harmless previously. Reported-by: Fixes: 14373711dd54 ("erofs: add on-disk compression configurations") Signed-off-by: Gao Xiang --- fs/erofs/decompressor.c | 2 +- fs/erofs/zmap.c | 15 ++++++++------- 2 files changed, 9 insertions(+), 8 deletions(-) diff --git a/fs/erofs/decompressor.c b/fs/erofs/decompressor.c index 021be5feb1bc..af98e88908ee 100644 --- a/fs/erofs/decompressor.c +++ b/fs/erofs/decompressor.c @@ -398,7 +398,7 @@ int z_erofs_parse_cfgs(struct super_block *sb, struct erofs_super_block *dsb) int size, ret = 0; if (!erofs_sb_has_compr_cfgs(sbi)) { - sbi->available_compr_algs = Z_EROFS_COMPRESSION_LZ4; + sbi->available_compr_algs = 1 << Z_EROFS_COMPRESSION_LZ4; return z_erofs_load_lz4_config(sb, dsb, NULL, 0); } diff --git a/fs/erofs/zmap.c b/fs/erofs/zmap.c index 7b55111fd533..d513f2cd7521 100644 --- a/fs/erofs/zmap.c +++ b/fs/erofs/zmap.c @@ -578,7 +578,8 @@ static int z_erofs_fill_inode_lazy(struct inode *inode) { struct erofs_inode *const vi = EROFS_I(inode); struct super_block *const sb = inode->i_sb; - int err, headnr; + struct erofs_sb_info *sbi = EROFS_SB(sb); + int err, nr; erofs_off_t pos; struct erofs_buf buf = __EROFS_BUF_INITIALIZER; void *kaddr; @@ -622,12 +623,12 @@ static int z_erofs_fill_inode_lazy(struct inode *inode) vi->z_algorithmtype[0] = h->h_algorithmtype & 15; vi->z_algorithmtype[1] = h->h_algorithmtype >> 4; - headnr = 0; - if (vi->z_algorithmtype[0] >= Z_EROFS_COMPRESSION_MAX || - vi->z_algorithmtype[++headnr] >= Z_EROFS_COMPRESSION_MAX) { - erofs_err(sb, "unknown HEAD%u format %u for nid %llu, please upgrade kernel", - headnr + 1, vi->z_algorithmtype[headnr], vi->nid); - err = -EOPNOTSUPP; + nr = 0; + if (!(sbi->available_compr_algs & (1 << vi->z_algorithmtype[0])) || + !(sbi->available_compr_algs & (1 << vi->z_algorithmtype[++nr]))) { + erofs_err(sb, "inconsistent HEAD%u algorithm format %u for nid %llu", + nr + 1, vi->z_algorithmtype[nr], vi->nid); + err = -EFSCORRUPTED; goto out_put_metabuf; }