From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id A22DF30EF67; Mon, 13 Oct 2025 15:20:11 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1760368811; cv=none; b=Uj2gsspii1saRJc2LM41DAyCL8jzpK4Z/pJDE+Wlt9lrDsds1s7au0BzOkjEdtqSUxo0Qyo1ORqCzXNyuJnZwNQnvv6QFdDa9wdcsnk3sh1uCctNzy61Te4cdnypaczg8rCPrzyf9qTbbrgEDmgH98YckFlhvwigqe/W0FX66+w= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1760368811; c=relaxed/simple; bh=QJWwb4Ea9qc8xgBrNMqeH4qS3gk14DKiJfL+HnRsVJQ=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=kTrt1nNSBbV7IGB8tV8fVzcvH16yFRprXpioTirK3cr7Hij8ZnfZUfNmus7pWJnJSCl+3tz/Xy7nem9oLV4fmsZ2ciRagbeUq4qGfafFaIjX6ddMz3BdiJdgTm3HRz6SD3WKgkWcY0I0PHBLhgXa1dHjpd991qrGH80y/FvW3Rk= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=Rnamcnx/; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="Rnamcnx/" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 26D74C4CEE7; Mon, 13 Oct 2025 15:20:10 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1760368811; bh=QJWwb4Ea9qc8xgBrNMqeH4qS3gk14DKiJfL+HnRsVJQ=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Rnamcnx/Xbm8piw+VMdvYRZFeDQaBxSdcsqgKuVjkUH55DNvyLKRi8Mzfxx1dKIx2 rkuyK7f/WHoQ6e9BywQvc+huFq7gTLZ1xSkqABJ3hIybCeYeX/yBNe9+kGoZLK11vG uixRbLAVH+0YE6Tk5FuSBY1MBPsKX0/Q+DkPe4Yk= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Hongbo Li , Chao Yu , Gao Xiang , Sasha Levin , syzbot+1a9af3ef3c84c5e14dcc@syzkaller.appspotmail.com Subject: [PATCH 6.17 028/563] erofs: avoid reading more for fragment maps Date: Mon, 13 Oct 2025 16:38:09 +0200 Message-ID: <20251013144412.307932709@linuxfoundation.org> X-Mailer: git-send-email 2.51.0 In-Reply-To: <20251013144411.274874080@linuxfoundation.org> References: <20251013144411.274874080@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: patches@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 6.17-stable review patch. If anyone has any objections, please let me know. ------------------ From: Gao Xiang [ Upstream commit 334c0e493c2aa3e843a80bb9f3862bb50360cb36 ] Since all real encoded extents (directly handled by the decompression subsystem) have a sane, limited maximum decoded length (Z_EROFS_PCLUSTER_MAX_DSIZE), and the read-more policy is only applied if needed. However, it makes no sense to read more for non-encoded maps, such as fragment extents, since such extents can be huge (up to i_size) and there is no benefit to reading more at this layer. For normal images, it does not really matter, but for crafted images generated by syzbot, excessively large fragment extents can cause read-more to run for an overly long time. Reported-and-tested-by: syzbot+1a9af3ef3c84c5e14dcc@syzkaller.appspotmail.com Closes: https://lore.kernel.org/r/68c8583d.050a0220.2ff435.03a3.GAE@google.com Fixes: b44686c8391b ("erofs: fix large fragment handling") Fixes: b15b2e307c3a ("erofs: support on-disk compressed fragments data") Reviewed-by: Hongbo Li Reviewed-by: Chao Yu Signed-off-by: Gao Xiang Signed-off-by: Sasha Levin --- fs/erofs/zdata.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/fs/erofs/zdata.c b/fs/erofs/zdata.c index 2d73297003d25..625b8ae8f67f0 100644 --- a/fs/erofs/zdata.c +++ b/fs/erofs/zdata.c @@ -1835,7 +1835,7 @@ static void z_erofs_pcluster_readmore(struct z_erofs_frontend *f, map->m_la = end; err = z_erofs_map_blocks_iter(inode, map, EROFS_GET_BLOCKS_READMORE); - if (err) + if (err || !(map->m_flags & EROFS_MAP_ENCODED)) return; /* expand ra for the trailing edge if readahead */ @@ -1847,7 +1847,7 @@ static void z_erofs_pcluster_readmore(struct z_erofs_frontend *f, end = round_up(end, PAGE_SIZE); } else { end = round_up(map->m_la, PAGE_SIZE); - if (!map->m_llen) + if (!(map->m_flags & EROFS_MAP_ENCODED) || !map->m_llen) return; } -- 2.51.0