[PATCH] erofs: fix unsigned underflow in LZ4 in-place decompression

[PATCH] erofs: fix unsigned underflow in LZ4 in-place decompression

[Liu Chao]

z_erofs_lz4_handle_overlap() computes the overlap offset between the
input and output page arrays as rq->outpages - rq->inpages.  Both
values are derived from on-disk pcluster metadata (pcl->length and
pcl->pclustersize) which an attacker can set independently, so
outpages may legitimately be smaller than inpages.  The unsigned
subtraction then underflows, causing rq->out[] to be indexed far out
of bounds and the returned LZ4 source pointer to point past the
output buffer, resulting in out-of-bounds reads and writes.

The in-place path is only valid when the output buffer is at least as
large as the input buffer, so guard the branch with
rq->outpages >= rq->inpages.  When the condition does not hold, fall
through to docopy, which copies the compressed data to the per-CPU
buffer and decompresses safely.

Reviewed-by: Fang Xieyan <fangxy@xiaopeng.com>
Signed-off-by: Liu Chao <liuc63@xiaopeng.com>
---
 fs/erofs/decompressor.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/fs/erofs/decompressor.c b/fs/erofs/decompressor.c
index 354762c97..50a5f9ddf 100644
--- a/fs/erofs/decompressor.c
+++ b/fs/erofs/decompressor.c
@@ -117,6 +117,7 @@ static void *z_erofs_lz4_handle_overlap(struct z_erofs_decompress_req *rq,
 		oend = rq->pageofs_out + rq->outputsize;
 		omargin = PAGE_ALIGN(oend) - oend;
 		if (rq->partial_decoding || !may_inplace ||
+		    rq->outpages < rq->inpages ||
 		    omargin < LZ4_DECOMPRESS_INPLACE_MARGIN(rq->inputsize))
 			goto docopy;
 
--
2.50.1

Re: [PATCH] erofs: fix unsigned underflow in LZ4 in-place decompression

[Gao Xiang]

Hi,

On Fri, Oct 16, 2026 at 12:11:43PM +0800, Liu Chao wrote:
> z_erofs_lz4_handle_overlap() computes the overlap offset between the
> input and output page arrays as rq->outpages - rq->inpages.  Both
> values are derived from on-disk pcluster metadata (pcl->length and
> pcl->pclustersize) which an attacker can set independently, so
> outpages may legitimately be smaller than inpages.  The unsigned
> subtraction then underflows, causing rq->out[] to be indexed far out
> of bounds and the returned LZ4 source pointer to point past the
> output buffer, resulting in out-of-bounds reads and writes.
> 
> The in-place path is only valid when the output buffer is at least as
> large as the input buffer, so guard the branch with
> rq->outpages >= rq->inpages.  When the condition does not hold, fall
> through to docopy, which copies the compressed data to the per-CPU
> buffer and decompresses safely.
> 
> Reviewed-by: Fang Xieyan <fangxy@xiaopeng.com>
> Signed-off-by: Liu Chao <liuc63@xiaopeng.com>
> ---
>  fs/erofs/decompressor.c | 1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/fs/erofs/decompressor.c b/fs/erofs/decompressor.c
> index 354762c97..50a5f9ddf 100644
> --- a/fs/erofs/decompressor.c
> +++ b/fs/erofs/decompressor.c
> @@ -117,6 +117,7 @@ static void *z_erofs_lz4_handle_overlap(struct z_erofs_decompress_req *rq,
>  		oend = rq->pageofs_out + rq->outputsize;
>  		omargin = PAGE_ALIGN(oend) - oend;
>  		if (rq->partial_decoding || !may_inplace ||
> +		    rq->outpages < rq->inpages ||

This is not against to the latest upstream, and
do you notice the following commits?

 commit 21e161de2dc660b1bb70ef5b156ab8e6e1cca3ab

 commit a5242d37c83abe86df95c6941e2ace9f9055ffcb

also do you have a reproducer?

Thanks,
Gao Xiang