[PATCH] erofs-utils: lib: fix xattr prefix offset truncation

[PATCH] erofs-utils: lib: fix xattr prefix offset truncation

[bingying lan]

xattr_prefix_start stores the long xattr prefix table offset in 4-byte
units.  Casting the byte offset to u32 before shifting discards its
upper bits, even though the overflow check accepts offsets whose
shifted value fits in u32.  The table is written at the full offset,
but the superblock points to the truncated location.

Shift the offset before narrowing it to u32.  This prevents corrupted
images when incremental builds place the prefix table at or beyond
4 GiB.

Fixes: b6b741d8daaf ("erofs-utils: lib: get rid of tmpfile()")
Signed-off-by: bingying lan <lanbingying.lby@linux.alibaba.com>
---
 lib/xattr.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/xattr.c b/lib/xattr.c
index d86d94a..e742bfc 100644
--- a/lib/xattr.c
+++ b/lib/xattr.c
@@ -921,7 +921,7 @@ int erofs_xattr_flush_name_prefixes(struct erofs_importer *im, bool plain)
 		return -EOVERFLOW;
 	start = offset;
 
-	sbi->xattr_prefix_start = (u32)offset >> 2;
+	sbi->xattr_prefix_start = (u32)(offset >> 2);
 	sbi->xattr_prefix_count = ea_prefix_count;
 
 	list_for_each_entry(tnode, &ea_name_prefixes, list) {
-- 
2.53.0.apsara

Re: [PATCH] erofs-utils: lib: fix xattr prefix offset truncation

[Gao Xiang]

Hi Bingying,

On Tue, Oct 20, 2026 at 01:52:18PM +0800, bingying lan wrote:
> xattr_prefix_start stores the long xattr prefix table offset in 4-byte
> units.  Casting the byte offset to u32 before shifting discards its
> upper bits, even though the overflow check accepts offsets whose
> shifted value fits in u32.  The table is written at the full offset,
> but the superblock points to the truncated location.
> 
> Shift the offset before narrowing it to u32.  This prevents corrupted
> images when incremental builds place the prefix table at or beyond
> 4 GiB.
> 
> Fixes: b6b741d8daaf ("erofs-utils: lib: get rid of tmpfile()")
> Signed-off-by: bingying lan <lanbingying.lby@linux.alibaba.com>
> ---
>  lib/xattr.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/lib/xattr.c b/lib/xattr.c
> index d86d94a..e742bfc 100644
> --- a/lib/xattr.c
> +++ b/lib/xattr.c
> @@ -921,7 +921,7 @@ int erofs_xattr_flush_name_prefixes(struct erofs_importer *im, bool plain)
>  		return -EOVERFLOW;
>  	start = offset;
>  
> -	sbi->xattr_prefix_start = (u32)offset >> 2;
> +	sbi->xattr_prefix_start = (u32)(offset >> 2);

Good catch:
Reviewed-by: Gao Xiang <xiang@kernel.org>

will move to -fixes after -rc1 is out.

Thanks,
Gao Xiang

Re: [PATCH] erofs-utils: lib: fix xattr prefix offset truncation

[Gao Xiang]

On Tue, Oct 20, 2026 at 01:52:18PM +0800, bingying lan wrote:
> xattr_prefix_start stores the long xattr prefix table offset in 4-byte
> units.  Casting the byte offset to u32 before shifting discards its
> upper bits, even though the overflow check accepts offsets whose
> shifted value fits in u32.  The table is written at the full offset,
> but the superblock points to the truncated location.
> 
> Shift the offset before narrowing it to u32.  This prevents corrupted
> images when incremental builds place the prefix table at or beyond
> 4 GiB.
> 
> Fixes: b6b741d8daaf ("erofs-utils: lib: get rid of tmpfile()")
> Signed-off-by: bingying lan <lanbingying.lby@linux.alibaba.com>
> ---
>  lib/xattr.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/lib/xattr.c b/lib/xattr.c
> index d86d94a..e742bfc 100644
> --- a/lib/xattr.c
> +++ b/lib/xattr.c
> @@ -921,7 +921,7 @@ int erofs_xattr_flush_name_prefixes(struct erofs_importer *im, bool plain)
>  		return -EOVERFLOW;
>  	start = offset;
>  
> -	sbi->xattr_prefix_start = (u32)offset >> 2;
> +	sbi->xattr_prefix_start = (u32)(offset >> 2);

oh, it seems an erofs-utils one, merging now.

Thanks,
Gao Xiang