Re: [PATCH 1/2] erofs: avoid infinite loops due to corrupted subpage compact indexes

[Hongbo Li]

On 2025/10/17 15:05, Gao Xiang wrote:

Robert reported an infinite loop observed by two crafted images.

The root cause is that `clusterofs` can be larger than `lclustersize`
for !NONHEAD `lclusters` in corrupted subpage compact indexes, e.g.:

   blocksize = lclustersize = 512   lcn = 6   clusterofs = 515

Move the corresponding check for full compress indexes to
`z_erofs_load_lcluster_from_disk()` to also cover subpage compact
compress indexes.

It also fixes the position of `m->type >= Z_EROFS_LCLUSTER_TYPE_MAX`
check, since it should be placed right after
`z_erofs_load_{compact,full}_lcluster()`.

Fixes: 8d2517aaeea3 ("erofs: fix up compacted indexes for block size < 4096")
Fixes: 1a5223c182fd ("erofs: do sanity check on m->type in 
z_erofs_load_compact_lcluster()")
Reported-by: Robert Morris <r...@csail.mit.edu>
Closes: https://lore.kernel.org/r/35167.1760645886@localhost
Signed-off-by: Gao Xiang <hsiang...@linux.alibaba.com>

The clusterofs is unused in NONHEAD lcluster, so it is easy to understand.

Reviewed-by: Hongbo Li <lihongb...@huawei.com>

Thanks,
Hongbo

---
  fs/erofs/zmap.c | 32 ++++++++++++++++++--------------
  1 file changed, 18 insertions(+), 14 deletions(-)

diff --git a/fs/erofs/zmap.c b/fs/erofs/zmap.c
index e5581dbeb4c2..6aca228cd2a5 100644
--- a/fs/erofs/zmap.c
+++ b/fs/erofs/zmap.c
@@ -55,10 +55,6 @@ static int z_erofs_load_full_lcluster(struct 
z_erofs_maprecorder *m,
        } else {
                m->partialref = !!(advise & Z_EROFS_LI_PARTIAL_REF);
                m->clusterofs = le16_to_cpu(di->di_clusterofs);
-               if (m->clusterofs >= 1 << vi->z_lclusterbits) {
-                       DBG_BUGON(1);
-                       return -EFSCORRUPTED;
-               }
                m->pblk = le32_to_cpu(di->di_u.blkaddr);
        }
        return 0;
@@ -240,21 +236,29 @@ static int z_erofs_load_compact_lcluster(struct 
z_erofs_maprecorder *m,
  static int z_erofs_load_lcluster_from_disk(struct z_erofs_maprecorder *m,
                                           unsigned int lcn, bool lookahead)
  {
+       struct erofs_inode *vi = EROFS_I(m->inode);
+       int err;
+
+       if (vi->datalayout == EROFS_INODE_COMPRESSED_COMPACT) {
+               err = z_erofs_load_compact_lcluster(m, lcn, lookahead);
+       } else {
+               DBG_BUGON(vi->datalayout != EROFS_INODE_COMPRESSED_FULL);
+               err = z_erofs_load_full_lcluster(m, lcn);
+       }
+       if (err)
+               return err;
+
        if (m->type >= Z_EROFS_LCLUSTER_TYPE_MAX) {
                erofs_err(m->inode->i_sb, "unknown type %u @ lcn %u of nid 
%llu",
-                               m->type, lcn, EROFS_I(m->inode)->nid);
+                         m->type, lcn, EROFS_I(m->inode)->nid);
                DBG_BUGON(1);
                return -EOPNOTSUPP;
+       } else if (m->type != Z_EROFS_LCLUSTER_TYPE_NONHEAD &&
+                  m->clusterofs >= (1 << vi->z_lclusterbits)) {
+               DBG_BUGON(1);
+               return -EFSCORRUPTED;
        }
-
-       switch (EROFS_I(m->inode)->datalayout) {
-       case EROFS_INODE_COMPRESSED_FULL:
-               return z_erofs_load_full_lcluster(m, lcn);
-       case EROFS_INODE_COMPRESSED_COMPACT:
-               return z_erofs_load_compact_lcluster(m, lcn, lookahead);
-       default:
-               return -EINVAL;
-       }
+       return 0;
  }

static int z_erofs_extent_lookback(struct z_erofs_maprecorder *m,