[PATCH] erofs: fix unbalanced buf->off handling in erofs_bread()

[PATCH] erofs: fix unbalanced buf->off handling in erofs_bread()

[binglei wang]

[-- Attachment #1: Type: text/plain, Size: 2137 bytes --]

erofs_bread() locates the target folio with

 index = (buf->off + offset) >> PAGE_SHIFT;

but computes the in-folio offset without taking buf->off into account:

 return buf->base + (offset & ~PAGE_MASK);

If buf->off is not page-aligned, the returned pointer misses the in-page
component of buf->off, so callers end up fetching data from a wrong
offset.

buf->off is set to sbi->dif0.fsoff in erofs_init_metabuf(), and fsoff can
be specified via the "fsoffset=" mount option, which only requires
block-size alignment. Therefore, on an image with a sub-page block size
(e.g. 512 bytes), a non-page-aligned fsoff (e.g. 512) triggers the issue,
since 512 is a multiple of the block size but not of PAGE_SIZE.

It can be reproduced by mounting an image that is placed at a
non-page-aligned offset:

 mkfs.erofs -b512 -zlz4hc sub.erofs src/
 # prepend 512 bytes of padding to the image
 mount -t erofs -o loop,fsoffset=512 padded.erofs /mnt

which fails with

 erofs (device loop0): cannot find valid erofs superblock

because the on-disk superblock (at offset 1024 within the image, i.e.
1536 within the padded file) is read from a wrong in-folio offset. With
this fixed, the very same image mounts successfully and its file contents
match those read from the unpadded image.

Fix it by including buf->off in the in-folio offset calculation, so that
it is consistent with the folio index calculation.

Fixes: c36ec00d7f67 ("erofs: add 'fsoffset' mount option to specify
filesystem offset")
Cc: <stable@vger.kernel.org> # 6.16+
Signed-off-by: Binglei Wang <l3b2w1@gmail.com>
---
 fs/erofs/data.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/erofs/data.c b/fs/erofs/data.c
index 0885b1f2fc92..be63b89f0862 100644
--- a/fs/erofs/data.c
+++ b/fs/erofs/data.c
@@ -48,7 +48,7 @@ void *erofs_bread(struct erofs_buf *buf, erofs_off_t
offset, bool need_kmap)
   return NULL;
  if (!buf->base)
   buf->base = kmap_local_page(buf->page);
- return buf->base + (offset & ~PAGE_MASK);
+ return buf->base + ((buf->off + offset) & ~PAGE_MASK);
 }

 int erofs_init_metabuf(struct erofs_buf *buf, struct super_block *sb,
-- 
2.33.0

[-- Attachment #2: Type: text/html, Size: 2532 bytes --]

Re: [PATCH] erofs: fix unbalanced buf->off handling in erofs_bread()

[Gao Xiang]

Hi,

On Fri, Sep 11, 2026 at 12:16:56PM +0800, binglei wang wrote:
> erofs_bread() locates the target folio with
> 
>  index = (buf->off + offset) >> PAGE_SHIFT;
> 
> but computes the in-folio offset without taking buf->off into account:
> 
>  return buf->base + (offset & ~PAGE_MASK);
> 
> If buf->off is not page-aligned, the returned pointer misses the in-page
> component of buf->off, so callers end up fetching data from a wrong
> offset.
> 
> buf->off is set to sbi->dif0.fsoff in erofs_init_metabuf(), and fsoff can
> be specified via the "fsoffset=" mount option, which only requires
> block-size alignment. Therefore, on an image with a sub-page block size
> (e.g. 512 bytes), a non-page-aligned fsoff (e.g. 512) triggers the issue,
> since 512 is a multiple of the block size but not of PAGE_SIZE.
> 
> It can be reproduced by mounting an image that is placed at a
> non-page-aligned offset:
> 
>  mkfs.erofs -b512 -zlz4hc sub.erofs src/
>  # prepend 512 bytes of padding to the image
>  mount -t erofs -o loop,fsoffset=512 padded.erofs /mnt
> 
> which fails with
> 
>  erofs (device loop0): cannot find valid erofs superblock
> 
> because the on-disk superblock (at offset 1024 within the image, i.e.
> 1536 within the padded file) is read from a wrong in-folio offset. With
> this fixed, the very same image mounts successfully and its file contents
> match those read from the unpadded image.
> 
> Fix it by including buf->off in the in-folio offset calculation, so that
> it is consistent with the folio index calculation.
> 
> Fixes: c36ec00d7f67 ("erofs: add 'fsoffset' mount option to specify
> filesystem offset")
> Cc: <stable@vger.kernel.org> # 6.16+
> Signed-off-by: Binglei Wang <l3b2w1@gmail.com>

As I said, I applied a modified version:
https://lore.kernel.org/r/aqOBLWQEkH7_3LSu@XiangdeMacBook-Pro.local

I think if you have some email client issue, you could loop the patch to
your own email, download it from your mailbox and try to apply locally
for self-testing first.

Thanks,
Gao Xiang

Re: [PATCH] erofs: fix unbalanced buf->off handling in erofs_bread()

[binglei wang]

[-- Attachment #1: Type: text/plain, Size: 2376 bytes --]

Thanks for the review. The code fix is unchanged. I've resent the patch in
plain text with proper formatting. Sorry for the noise.

Gao Xiang <xiang@kernel.org> 于 2026年9月11日周五 12:22写道：

> Hi,
>
> On Fri, Sep 11, 2026 at 12:16:56PM +0800, binglei wang wrote:
> > erofs_bread() locates the target folio with
> >
> >  index = (buf->off + offset) >> PAGE_SHIFT;
> >
> > but computes the in-folio offset without taking buf->off into account:
> >
> >  return buf->base + (offset & ~PAGE_MASK);
> >
> > If buf->off is not page-aligned, the returned pointer misses the in-page
> > component of buf->off, so callers end up fetching data from a wrong
> > offset.
> >
> > buf->off is set to sbi->dif0.fsoff in erofs_init_metabuf(), and fsoff can
> > be specified via the "fsoffset=" mount option, which only requires
> > block-size alignment. Therefore, on an image with a sub-page block size
> > (e.g. 512 bytes), a non-page-aligned fsoff (e.g. 512) triggers the issue,
> > since 512 is a multiple of the block size but not of PAGE_SIZE.
> >
> > It can be reproduced by mounting an image that is placed at a
> > non-page-aligned offset:
> >
> >  mkfs.erofs -b512 -zlz4hc sub.erofs src/
> >  # prepend 512 bytes of padding to the image
> >  mount -t erofs -o loop,fsoffset=512 padded.erofs /mnt
> >
> > which fails with
> >
> >  erofs (device loop0): cannot find valid erofs superblock
> >
> > because the on-disk superblock (at offset 1024 within the image, i.e.
> > 1536 within the padded file) is read from a wrong in-folio offset. With
> > this fixed, the very same image mounts successfully and its file contents
> > match those read from the unpadded image.
> >
> > Fix it by including buf->off in the in-folio offset calculation, so that
> > it is consistent with the folio index calculation.
> >
> > Fixes: c36ec00d7f67 ("erofs: add 'fsoffset' mount option to specify
> > filesystem offset")
> > Cc: <stable@vger.kernel.org> # 6.16+
> > Signed-off-by: Binglei Wang <l3b2w1@gmail.com>
>
> As I said, I applied a modified version:
> https://lore.kernel.org/r/aqOBLWQEkH7_3LSu@XiangdeMacBook-Pro.local
>
> I think if you have some email client issue, you could loop the patch to
> your own email, download it from your mailbox and try to apply locally
> for self-testing first.
>
> Thanks,
> Gao Xiang
>

[-- Attachment #2: Type: text/html, Size: 3253 bytes --]

[PATCH] erofs: fix unbalanced buf->off handling in erofs_bread()

[Binglei Wang]

From: Binglei Wang <l3b2w1@gmail.com>

erofs_bread() locates the target folio with

	index = (buf->off + offset) >> PAGE_SHIFT;

but computes the in-folio offset without taking buf->off into account:

	return buf->base + (offset & ~PAGE_MASK);

If buf->off is not page-aligned, the returned pointer misses the in-page
component of buf->off, so callers end up fetching data from a wrong
offset.

buf->off is set to sbi->dif0.fsoff in erofs_init_metabuf(), and fsoff can
be specified via the "fsoffset=" mount option, which only requires
block-size alignment.  Therefore, on an image with a sub-page block size
(e.g. 512 bytes), a non-page-aligned fsoff (e.g. 512) triggers the issue,
since 512 is a multiple of the block size but not of PAGE_SIZE.

It can be reproduced by mounting an image that is placed at a
non-page-aligned offset:

	mkfs.erofs -b512 -zlz4hc sub.erofs src/
	# prepend 512 bytes of padding to the image
	mount -t erofs -o loop,fsoffset=512 padded.erofs /mnt

which fails with

	erofs (device loop0): cannot find valid erofs superblock

because the on-disk superblock (at offset 1024 within the image, i.e.
1536 within the padded file) is read from a wrong in-folio offset.  With
this fixed, the very same image mounts successfully and its file contents
match those read from the unpadded image.

Fix it by including buf->off in the in-folio offset calculation, so that
it is consistent with the folio index calculation.

Fixes: c36ec00d7f67 ("erofs: add 'fsoffset' mount option to specify filesystem offset")
Cc: <stable@vger.kernel.org> # 6.16+
Signed-off-by: Binglei Wang <l3b2w1@gmail.com>
---
 fs/erofs/data.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/erofs/data.c b/fs/erofs/data.c
index 0885b1f2fc92..be63b89f0862 100644
--- a/fs/erofs/data.c
+++ b/fs/erofs/data.c
@@ -48,7 +48,7 @@ void *erofs_bread(struct erofs_buf *buf, erofs_off_t offset, bool need_kmap)
 		return NULL;
 	if (!buf->base)
 		buf->base = kmap_local_page(buf->page);
-	return buf->base + (offset & ~PAGE_MASK);
+	return buf->base + ((buf->off + offset) & ~PAGE_MASK);
 }

 int erofs_init_metabuf(struct erofs_buf *buf, struct super_block *sb,
--
2.33.0

Re: [PATCH] erofs: fix unbalanced buf->off handling in erofs_bread()

[Gao Xiang]

On Sat, Sep 12, 2026 at 10:57:09AM +0800, Binglei Wang wrote:
> From: Binglei Wang <l3b2w1@gmail.com>
> 
> erofs_bread() locates the target folio with
> 
> 	index = (buf->off + offset) >> PAGE_SHIFT;
> 
> but computes the in-folio offset without taking buf->off into account:
> 
> 	return buf->base + (offset & ~PAGE_MASK);
> 
> If buf->off is not page-aligned, the returned pointer misses the in-page
> component of buf->off, so callers end up fetching data from a wrong
> offset.
> 
> buf->off is set to sbi->dif0.fsoff in erofs_init_metabuf(), and fsoff can
> be specified via the "fsoffset=" mount option, which only requires
> block-size alignment.  Therefore, on an image with a sub-page block size
> (e.g. 512 bytes), a non-page-aligned fsoff (e.g. 512) triggers the issue,
> since 512 is a multiple of the block size but not of PAGE_SIZE.
> 
> It can be reproduced by mounting an image that is placed at a
> non-page-aligned offset:
> 
> 	mkfs.erofs -b512 -zlz4hc sub.erofs src/
> 	# prepend 512 bytes of padding to the image
> 	mount -t erofs -o loop,fsoffset=512 padded.erofs /mnt
> 
> which fails with
> 
> 	erofs (device loop0): cannot find valid erofs superblock
> 
> because the on-disk superblock (at offset 1024 within the image, i.e.
> 1536 within the padded file) is read from a wrong in-folio offset.  With
> this fixed, the very same image mounts successfully and its file contents
> match those read from the unpadded image.
> 
> Fix it by including buf->off in the in-folio offset calculation, so that
> it is consistent with the folio index calculation.
> 
> Fixes: c36ec00d7f67 ("erofs: add 'fsoffset' mount option to specify filesystem offset")
> Cc: <stable@vger.kernel.org> # 6.16+
> Signed-off-by: Binglei Wang <l3b2w1@gmail.com>

As I said, I aiready applied a version before, please don't
send it again.

Thanks,
Gao Xiang

[PATCH] erofs: fix unbalanced buf->off handling in erofs_bread()

[binglei wang]

[-- Attachment #1: Type: text/plain, Size: 2131 bytes --]

erofs_bread() locates the target folio with

index = (buf->off + offset) >> PAGE_SHIFT;

but computes the in-folio offset without taking buf->off into account:

return buf->base + (offset & ~PAGE_MASK);

If buf->off is not page-aligned, the returned pointer misses the in-page
component of buf->off, so callers end up fetching data from a wrong
offset.

buf->off is set to sbi->dif0.fsoff in erofs_init_metabuf(), and fsoff can
be specified via the "fsoffset=" mount option, which only requires
block-size alignment.  Therefore, on an image with a sub-page block size
(e.g. 512 bytes), a non-page-aligned fsoff (e.g. 512) triggers the issue,
since 512 is a multiple of the block size but not of PAGE_SIZE.

It can be reproduced by mounting an image that is placed at a
non-page-aligned offset:

mkfs.erofs -b512 -zlz4hc sub.erofs src/
# prepend 512 bytes of padding to the image
mount -t erofs -o loop,fsoffset=512 padded.erofs /mnt

which fails with

erofs (device loop0): cannot find valid erofs superblock

because the on-disk superblock (at offset 1024 within the image, i.e.
1536 within the padded file) is read from a wrong in-folio offset.  With
this fixed, the very same image mounts successfully and its file contents
match those read from the unpadded image.

Fix it by including buf->off in the in-folio offset calculation, so that
it is consistent with the folio index calculation.

Fixes: c36ec00d7f67 ("erofs: add 'fsoffset' mount option to specify
filesystem offset")
Cc: <stable@vger.kernel.org> # 6.16+
Signed-off-by: Binglei Wang <l3b2w1@gmail.com>
---
 fs/erofs/data.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/erofs/data.c b/fs/erofs/data.c
index 0885b1f2fc92..be63b89f0862 100644
--- a/fs/erofs/data.c
+++ b/fs/erofs/data.c
@@ -48,7 +48,7 @@ void *erofs_bread(struct erofs_buf *buf, erofs_off_t
offset, bool need_kmap)
  return NULL;
  if (!buf->base)
  buf->base = kmap_local_page(buf->page);
- return buf->base + (offset & ~PAGE_MASK);
+ return buf->base + ((buf->off + offset) & ~PAGE_MASK);
 }

 int erofs_init_metabuf(struct erofs_buf *buf, struct super_block *sb,
-- 
2.33.0

[-- Attachment #2: Type: text/html, Size: 2583 bytes --]

[PATCH] erofs: fix unbalanced buf->off handling in erofs_bread()

[binglei wang]

[-- Attachment #1: Type: text/plain, Size: 2137 bytes --]

erofs_bread() locates the target folio with

 index = (buf->off + offset) >> PAGE_SHIFT;

but computes the in-folio offset without taking buf->off into account:

 return buf->base + (offset & ~PAGE_MASK);

If buf->off is not page-aligned, the returned pointer misses the in-page
component of buf->off, so callers end up fetching data from a wrong
offset.

buf->off is set to sbi->dif0.fsoff in erofs_init_metabuf(), and fsoff can
be specified via the "fsoffset=" mount option, which only requires
block-size alignment. Therefore, on an image with a sub-page block size
(e.g. 512 bytes), a non-page-aligned fsoff (e.g. 512) triggers the issue,
since 512 is a multiple of the block size but not of PAGE_SIZE.

It can be reproduced by mounting an image that is placed at a
non-page-aligned offset:

 mkfs.erofs -b512 -zlz4hc sub.erofs src/
 # prepend 512 bytes of padding to the image
 mount -t erofs -o loop,fsoffset=512 padded.erofs /mnt

which fails with

 erofs (device loop0): cannot find valid erofs superblock

because the on-disk superblock (at offset 1024 within the image, i.e.
1536 within the padded file) is read from a wrong in-folio offset. With
this fixed, the very same image mounts successfully and its file contents
match those read from the unpadded image.

Fix it by including buf->off in the in-folio offset calculation, so that
it is consistent with the folio index calculation.

Fixes: c36ec00d7f67 ("erofs: add 'fsoffset' mount option to specify
filesystem offset")
Cc: <stable@vger.kernel.org> # 6.16+
Signed-off-by: Binglei Wang <l3b2w1@gmail.com>
---
 fs/erofs/data.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/erofs/data.c b/fs/erofs/data.c
index 0885b1f2fc92..be63b89f0862 100644
--- a/fs/erofs/data.c
+++ b/fs/erofs/data.c
@@ -48,7 +48,7 @@ void *erofs_bread(struct erofs_buf *buf, erofs_off_t
offset, bool need_kmap)
   return NULL;
  if (!buf->base)
   buf->base = kmap_local_page(buf->page);
- return buf->base + (offset & ~PAGE_MASK);
+ return buf->base + ((buf->off + offset) & ~PAGE_MASK);
 }

 int erofs_init_metabuf(struct erofs_buf *buf, struct super_block *sb,
-- 
2.33.0

[-- Attachment #2: Type: text/html, Size: 3632 bytes --]

Re: [PATCH] erofs: fix unbalanced buf->off handling in erofs_bread()

[Gao Xiang]

Hi Binglei,

On Fri, Sep 11, 2026 at 12:01:48PM +0800, binglei wang wrote:
> erofs_bread() locates the target folio with
> 
>  index = (buf->off + offset) >> PAGE_SHIFT;
> 
> but computes the in-folio offset without taking buf->off into account:
> 
>  return buf->base + (offset & ~PAGE_MASK);
> 
> If buf->off is not page-aligned, the returned pointer misses the in-page
> component of buf->off, so callers end up fetching data from a wrong
> offset.
> 
> buf->off is set to sbi->dif0.fsoff in erofs_init_metabuf(), and fsoff can
> be specified via the "fsoffset=" mount option, which only requires
> block-size alignment. Therefore, on an image with a sub-page block size
> (e.g. 512 bytes), a non-page-aligned fsoff (e.g. 512) triggers the issue,
> since 512 is a multiple of the block size but not of PAGE_SIZE.
> 
> It can be reproduced by mounting an image that is placed at a
> non-page-aligned offset:
> 
>  mkfs.erofs -b512 -zlz4hc sub.erofs src/
>  # prepend 512 bytes of padding to the image
>  mount -t erofs -o loop,fsoffset=512 padded.erofs /mnt
> 
> which fails with
> 
>  erofs (device loop0): cannot find valid erofs superblock
> 
> because the on-disk superblock (at offset 1024 within the image, i.e.
> 1536 within the padded file) is read from a wrong in-folio offset. With
> this fixed, the very same image mounts successfully and its file contents
> match those read from the unpadded image.
> 
> Fix it by including buf->off in the in-folio offset calculation, so that
> it is consistent with the folio index calculation.
> 
> Fixes: c36ec00d7f67 ("erofs: add 'fsoffset' mount option to specify
> filesystem offset")
> Cc: <stable@vger.kernel.org> # 6.16+
> Signed-off-by: Binglei Wang <l3b2w1@gmail.com>

The fix looks fine, but the patch format is broken:
Reviewed-by: Gao Xiang <xiang@kernel.org>

I applied the following version manually with an updated
patch subject.

From 135d84c66f85426299db01a09d93a79a87af18ba Mon Sep 17 00:00:00 2001
From: Binglei Wang <l3b2w1@gmail.com>
Date: Fri, 11 Sep 2026 12:11:33 +0800
Subject: [PATCH] erofs: add missing buf->off in erofs_bread()

erofs_bread() locates the target folio with

 index = (buf->off + offset) >> PAGE_SHIFT;

but computes the in-folio offset without taking buf->off into account:

 return buf->base + (offset & ~PAGE_MASK);

If buf->off is not page-aligned, the returned pointer misses the in-page
component of buf->off, so callers end up fetching data from a wrong
offset.

buf->off is set to sbi->dif0.fsoff in erofs_init_metabuf(), and fsoff can
be specified via the "fsoffset=" mount option, which only requires
block-size alignment. Therefore, on an image with a sub-page block size
(e.g. 512 bytes), a non-page-aligned fsoff (e.g. 512) triggers the issue,
since 512 is a multiple of the block size but not of PAGE_SIZE.

It can be reproduced by mounting an image that is placed at a
non-page-aligned offset:

 mkfs.erofs -b512 -zlz4hc sub.erofs src/
 # prepend 512 bytes of padding to the image
 mount -t erofs -o loop,fsoffset=512 padded.erofs /mnt

which fails with

 erofs (device loop0): cannot find valid erofs superblock

because the on-disk superblock (at offset 1024 within the image, i.e.
1536 within the padded file) is read from a wrong in-folio offset. With
this fixed, the very same image mounts successfully and its file contents
match those read from the unpadded image.

Fix it by including buf->off in the in-folio offset calculation, so that
it is consistent with the folio index calculation.

Fixes: c36ec00d7f67 ("erofs: add 'fsoffset' mount option to specify filesystem offset")
Signed-off-by: Binglei Wang <l3b2w1@gmail.com>
Reviewed-by: Gao Xiang <xiang@kernel.org>
Signed-off-by: Gao Xiang <xiang@kernel.org>
---
 fs/erofs/data.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/erofs/data.c b/fs/erofs/data.c
index 0885b1f2fc92..be63b89f0862 100644
--- a/fs/erofs/data.c
+++ b/fs/erofs/data.c
@@ -48,7 +48,7 @@ void *erofs_bread(struct erofs_buf *buf, erofs_off_t offset, bool need_kmap)
 		return NULL;
 	if (!buf->base)
 		buf->base = kmap_local_page(buf->page);
-	return buf->base + (offset & ~PAGE_MASK);
+	return buf->base + ((buf->off + offset) & ~PAGE_MASK);
 }
 
 int erofs_init_metabuf(struct erofs_buf *buf, struct super_block *sb,
-- 
2.47.3

Re: [PATCH] erofs: fix unbalanced buf->off handling in erofs_bread()

[binglei wang]

[-- Attachment #1: Type: text/plain, Size: 4784 bytes --]

Thanks for the feedback!  I will check it.

Gao Xiang <xiang@kernel.org> 于2026年9月11日周五 12:19写道：

> Hi Binglei,
>
> On Fri, Sep 11, 2026 at 12:01:48PM +0800, binglei wang wrote:
> > erofs_bread() locates the target folio with
> >
> >  index = (buf->off + offset) >> PAGE_SHIFT;
> >
> > but computes the in-folio offset without taking buf->off into account:
> >
> >  return buf->base + (offset & ~PAGE_MASK);
> >
> > If buf->off is not page-aligned, the returned pointer misses the in-page
> > component of buf->off, so callers end up fetching data from a wrong
> > offset.
> >
> > buf->off is set to sbi->dif0.fsoff in erofs_init_metabuf(), and fsoff can
> > be specified via the "fsoffset=" mount option, which only requires
> > block-size alignment. Therefore, on an image with a sub-page block size
> > (e.g. 512 bytes), a non-page-aligned fsoff (e.g. 512) triggers the issue,
> > since 512 is a multiple of the block size but not of PAGE_SIZE.
> >
> > It can be reproduced by mounting an image that is placed at a
> > non-page-aligned offset:
> >
> >  mkfs.erofs -b512 -zlz4hc sub.erofs src/
> >  # prepend 512 bytes of padding to the image
> >  mount -t erofs -o loop,fsoffset=512 padded.erofs /mnt
> >
> > which fails with
> >
> >  erofs (device loop0): cannot find valid erofs superblock
> >
> > because the on-disk superblock (at offset 1024 within the image, i.e.
> > 1536 within the padded file) is read from a wrong in-folio offset. With
> > this fixed, the very same image mounts successfully and its file contents
> > match those read from the unpadded image.
> >
> > Fix it by including buf->off in the in-folio offset calculation, so that
> > it is consistent with the folio index calculation.
> >
> > Fixes: c36ec00d7f67 ("erofs: add 'fsoffset' mount option to specify
> > filesystem offset")
> > Cc: <stable@vger.kernel.org> # 6.16+
> > Signed-off-by: Binglei Wang <l3b2w1@gmail.com>
>
> The fix looks fine, but the patch format is broken:
> Reviewed-by: Gao Xiang <xiang@kernel.org>
>
> I applied the following version manually with an updated
> patch subject.
>
> From 135d84c66f85426299db01a09d93a79a87af18ba Mon Sep 17 00:00:00 2001
> From: Binglei Wang <l3b2w1@gmail.com>
> Date: Fri, 11 Sep 2026 12:11:33 +0800
> Subject: [PATCH] erofs: add missing buf->off in erofs_bread()
>
> erofs_bread() locates the target folio with
>
>  index = (buf->off + offset) >> PAGE_SHIFT;
>
> but computes the in-folio offset without taking buf->off into account:
>
>  return buf->base + (offset & ~PAGE_MASK);
>
> If buf->off is not page-aligned, the returned pointer misses the in-page
> component of buf->off, so callers end up fetching data from a wrong
> offset.
>
> buf->off is set to sbi->dif0.fsoff in erofs_init_metabuf(), and fsoff can
> be specified via the "fsoffset=" mount option, which only requires
> block-size alignment. Therefore, on an image with a sub-page block size
> (e.g. 512 bytes), a non-page-aligned fsoff (e.g. 512) triggers the issue,
> since 512 is a multiple of the block size but not of PAGE_SIZE.
>
> It can be reproduced by mounting an image that is placed at a
> non-page-aligned offset:
>
>  mkfs.erofs -b512 -zlz4hc sub.erofs src/
>  # prepend 512 bytes of padding to the image
>  mount -t erofs -o loop,fsoffset=512 padded.erofs /mnt
>
> which fails with
>
>  erofs (device loop0): cannot find valid erofs superblock
>
> because the on-disk superblock (at offset 1024 within the image, i.e.
> 1536 within the padded file) is read from a wrong in-folio offset. With
> this fixed, the very same image mounts successfully and its file contents
> match those read from the unpadded image.
>
> Fix it by including buf->off in the in-folio offset calculation, so that
> it is consistent with the folio index calculation.
>
> Fixes: c36ec00d7f67 ("erofs: add 'fsoffset' mount option to specify
> filesystem offset")
> Signed-off-by: Binglei Wang <l3b2w1@gmail.com>
> Reviewed-by: Gao Xiang <xiang@kernel.org>
> Signed-off-by: Gao Xiang <xiang@kernel.org>
> ---
>  fs/erofs/data.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/fs/erofs/data.c b/fs/erofs/data.c
> index 0885b1f2fc92..be63b89f0862 100644
> --- a/fs/erofs/data.c
> +++ b/fs/erofs/data.c
> @@ -48,7 +48,7 @@ void *erofs_bread(struct erofs_buf *buf, erofs_off_t
> offset, bool need_kmap)
>                 return NULL;
>         if (!buf->base)
>                 buf->base = kmap_local_page(buf->page);
> -       return buf->base + (offset & ~PAGE_MASK);
> +       return buf->base + ((buf->off + offset) & ~PAGE_MASK);
>  }
>
>  int erofs_init_metabuf(struct erofs_buf *buf, struct super_block *sb,
> --
> 2.47.3
>
>

[-- Attachment #2: Type: text/html, Size: 6083 bytes --]