Commit 131897c6 authored by Gao Xiang's avatar Gao Xiang
Browse files

erofs: fix invalid algorithm for encoded extents 



The current algorithm sanity checks do not properly apply to new
encoded extents.

Unify the algorithm check with Z_EROFS_COMPRESSION(_RUNTIME)_MAX
and ensure consistency with sbi->available_compr_algs.

Reported-and-tested-by: default avatar <syzbot+5a398eb460ddaa6f242f@syzkaller.appspotmail.com>
Closes: https://lore.kernel.org/r/68a8bd20.050a0220.37038e.005a.GAE@google.com


Fixes: 1d191b4c ("erofs: implement encoded extent metadata")
Thanks-to: Edward Adam Davis <eadavis@qq.com>
Signed-off-by: default avatarGao Xiang <hsiangkao@linux.alibaba.com>
parent c17b750b

fs/erofs/zmap.c

+37 −30
Original line number Diff line number Diff line
@@ -394,10 +394,10 @@ static int z_erofs_map_blocks_fo(struct inode *inode, 
		.map = map,

		.in_mbox = erofs_inode_in_metabox(inode),

	};

	int err = 0;

	unsigned int endoff, afmt;

	unsigned int endoff;

	unsigned long initial_lcn;

	unsigned long long ofs, end;

	int err;



	ofs = flags & EROFS_GET_BLOCKS_FINDTAIL ? inode->i_size - 1 : map->m_la;

	if (fragment && !(flags & EROFS_GET_BLOCKS_FINDTAIL) &&
@@ -482,20 +482,15 @@ static int z_erofs_map_blocks_fo(struct inode *inode, 
			err = -EFSCORRUPTED;

			goto unmap_out;

		}

		afmt = vi->z_advise & Z_EROFS_ADVISE_INTERLACED_PCLUSTER ?

			Z_EROFS_COMPRESSION_INTERLACED :

			Z_EROFS_COMPRESSION_SHIFTED;

		if (vi->z_advise & Z_EROFS_ADVISE_INTERLACED_PCLUSTER)

			map->m_algorithmformat = Z_EROFS_COMPRESSION_INTERLACED;

		else

			map->m_algorithmformat = Z_EROFS_COMPRESSION_SHIFTED;

	} else if (m.headtype == Z_EROFS_LCLUSTER_TYPE_HEAD2) {

		map->m_algorithmformat = vi->z_algorithmtype[1];

	} else {

		afmt = m.headtype == Z_EROFS_LCLUSTER_TYPE_HEAD2 ?

			vi->z_algorithmtype[1] : vi->z_algorithmtype[0];

		if (!(EROFS_I_SB(inode)->available_compr_algs & (1 << afmt))) {

			erofs_err(sb, "inconsistent algorithmtype %u for nid %llu",

				  afmt, vi->nid);

			err = -EFSCORRUPTED;

			goto unmap_out;

		}

		map->m_algorithmformat = vi->z_algorithmtype[0];

	}

	map->m_algorithmformat = afmt;



	if ((flags & EROFS_GET_BLOCKS_FIEMAP) ||

	    ((flags & EROFS_GET_BLOCKS_READMORE) &&
@@ -626,9 +621,9 @@ static int z_erofs_fill_inode(struct inode *inode, struct erofs_map_blocks *map) 
{

	struct erofs_inode *const vi = EROFS_I(inode);

	struct super_block *const sb = inode->i_sb;

	int err, headnr;

	erofs_off_t pos;

	struct z_erofs_map_header *h;

	erofs_off_t pos;

	int err = 0;



	if (test_bit(EROFS_I_Z_INITED_BIT, &vi->flags)) {

		/*
@@ -642,7 +637,6 @@ static int z_erofs_fill_inode(struct inode *inode, struct erofs_map_blocks *map) 
	if (wait_on_bit_lock(&vi->flags, EROFS_I_BL_Z_BIT, TASK_KILLABLE))

		return -ERESTARTSYS;



	err = 0;

	if (test_bit(EROFS_I_Z_INITED_BIT, &vi->flags))

		goto out_unlock;
@@ -679,15 +673,6 @@ static int z_erofs_fill_inode(struct inode *inode, struct erofs_map_blocks *map) 
	else if (vi->z_advise & Z_EROFS_ADVISE_INLINE_PCLUSTER)

		vi->z_idata_size = le16_to_cpu(h->h_idata_size);



	headnr = 0;

	if (vi->z_algorithmtype[0] >= Z_EROFS_COMPRESSION_MAX ||

	    vi->z_algorithmtype[++headnr] >= Z_EROFS_COMPRESSION_MAX) {

		erofs_err(sb, "unknown HEAD%u format %u for nid %llu, please upgrade kernel",

			  headnr + 1, vi->z_algorithmtype[headnr], vi->nid);

		err = -EOPNOTSUPP;

		goto out_unlock;

	}



	if (!erofs_sb_has_big_pcluster(EROFS_SB(sb)) &&

	    vi->z_advise & (Z_EROFS_ADVISE_BIG_PCLUSTER_1 |

			    Z_EROFS_ADVISE_BIG_PCLUSTER_2)) {
@@ -726,6 +711,30 @@ static int z_erofs_fill_inode(struct inode *inode, struct erofs_map_blocks *map) 
	return err;

}



static int z_erofs_map_sanity_check(struct inode *inode,

				    struct erofs_map_blocks *map)

{

	struct erofs_sb_info *sbi = EROFS_I_SB(inode);



	if (!(map->m_flags & EROFS_MAP_ENCODED))

		return 0;

	if (unlikely(map->m_algorithmformat >= Z_EROFS_COMPRESSION_RUNTIME_MAX)) {

		erofs_err(inode->i_sb, "unknown algorithm %d @ pos %llu for nid %llu, please upgrade kernel",

			  map->m_algorithmformat, map->m_la, EROFS_I(inode)->nid);

		return -EOPNOTSUPP;

	}

	if (unlikely(map->m_algorithmformat < Z_EROFS_COMPRESSION_MAX &&

		     !(sbi->available_compr_algs & (1 << map->m_algorithmformat)))) {

		erofs_err(inode->i_sb, "inconsistent algorithmtype %u for nid %llu",

			  map->m_algorithmformat, EROFS_I(inode)->nid);

		return -EFSCORRUPTED;

	}

	if (unlikely(map->m_plen > Z_EROFS_PCLUSTER_MAX_SIZE ||

		     map->m_llen > Z_EROFS_PCLUSTER_MAX_DSIZE))

		return -EOPNOTSUPP;

	return 0;

}



int z_erofs_map_blocks_iter(struct inode *inode, struct erofs_map_blocks *map,

			    int flags)

{
@@ -746,10 +755,8 @@ int z_erofs_map_blocks_iter(struct inode *inode, struct erofs_map_blocks *map, 
			else

				err = z_erofs_map_blocks_fo(inode, map, flags);

		}

		if (!err && (map->m_flags & EROFS_MAP_ENCODED) &&

		    unlikely(map->m_plen > Z_EROFS_PCLUSTER_MAX_SIZE ||

			     map->m_llen > Z_EROFS_PCLUSTER_MAX_DSIZE))

			err = -EOPNOTSUPP;

		if (!err)

			err = z_erofs_map_sanity_check(inode, map);

		if (err)

			map->m_llen = 0;

	}