Commit 21e161de authored by Junrui Luo's avatar Junrui Luo Committed by Gao Xiang
Browse files

erofs: fix unsigned underflow in z_erofs_lz4_handle_overlap() 



Some crafted images can have illegal (!partial_decoding &&
m_llen < m_plen) extents, and the LZ4 inplace decompression path
can be wrongly hit, but it cannot handle (outpages < inpages)
properly: "outpages - inpages" wraps to a large value and
the subsequent rq->out[] access reads past the decompressed_pages
array.

However, such crafted cases can correctly result in a corruption
report in the normal LZ4 non-inplace path.

Let's add an additional check to fix this for backporting.

Reproducible image (base64-encoded gzipped blob):

H4sIAJGR12kCA+3SPUoDQRgG4MkmkkZk8QRbRFIIi9hbpEjrHQI5ghfwCN5BLCzTGtLbBI+g
dilSJo1CnIm7GEXFxhT6PDDwfrs73/ywIQD/1ePD4r7Ou6ETsrq4mu7XcWfj++Pb58nJU/9i
PNtbjhan04/9GtX4qVYc814WDqt6FaX5s+ZwXXeq52lndT6IuVvlblytLMvh4Gzwaf90nsvz
2DF/21+20T/ldgp5s1jXRaN4t/8izsy/OUB6e/Qa79r+JwAAAAAAAL52vQVuGQAAAP6+my1w
ywAAAAAAAADwu14ATsEYtgBQAAA=

$ mount -t erofs -o cache_strategy=disabled foo.erofs /mnt
$ dd if=/mnt/data of=/dev/null bs=4096 count=1

Fixes: 598162d0 ("erofs: support decompress big pcluster for lz4 backend")
Reported-by: default avatarYuhao Jiang <danisjiang@gmail.com>
Cc: stable@vger.kernel.org
Signed-off-by: default avatarJunrui Luo <moonafterrain@outlook.com>
Reviewed-by: default avatarGao Xiang <hsiangkao@linux.alibaba.com>
Signed-off-by: default avatarGao Xiang <hsiangkao@linux.alibaba.com>
parent 63c2f061

fs/erofs/decompressor.c

+1 −0
Original line number Diff line number Diff line
@@ -145,6 +145,7 @@ static void *z_erofs_lz4_handle_overlap(const struct z_erofs_decompress_req *rq, 
	oend = rq->pageofs_out + rq->outputsize;

	omargin = PAGE_ALIGN(oend) - oend;

	if (!rq->partial_decoding && may_inplace &&

	    rq->outpages >= rq->inpages &&

	    omargin >= LZ4_DECOMPRESS_INPLACE_MARGIN(rq->inputsize)) {

		for (i = 0; i < rq->inpages; ++i)

			if (rq->out[rq->outpages - rq->inpages + i] !=