Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 3dab5ba6 authored by Gao Xiang's avatar Gao Xiang Committed by Greg Kroah-Hartman
Browse files

staging: erofs: detect potential multiref due to corrupted images 



commit e12a0ce2fa69798194f3a8628baf6edfbd5c548f upstream.

As reported by erofs-utils fuzzer, currently, multiref
(ondisk deduplication) hasn't been supported for now,
we should forbid it properly.

Fixes: 3883a79a ("staging: erofs: introduce VLE decompression support")
Cc: <stable@vger.kernel.org> # 4.19+
Signed-off-by: default avatarGao Xiang <gaoxiang25@huawei.com>
Reviewed-by: default avatarChao Yu <yuchao0@huawei.com>
Link: https://lore.kernel.org/r/20190821140152.229648-1-gaoxiang25@huawei.com


[ Gao Xiang: Since earlier kernels don't define EFSCORRUPTED,
             let's use EIO instead. ]
Signed-off-by: default avatarGao Xiang <gaoxiang25@huawei.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 8b4341f9

drivers/staging/erofs/unzip_vle.c

+17 −3
Original line number Diff line number Diff line
@@ -857,6 +857,7 @@ static int z_erofs_vle_unzip(struct super_block *sb, 
	for (i = 0; i < nr_pages; ++i)

		pages[i] = NULL;



	err = 0;

	z_erofs_pagevec_ctor_init(&ctor,

		Z_EROFS_VLE_INLINE_PAGEVECS, work->pagevec, 0);
@@ -878,8 +879,17 @@ static int z_erofs_vle_unzip(struct super_block *sb, 
			pagenr = z_erofs_onlinepage_index(page);



		DBG_BUGON(pagenr >= nr_pages);

		DBG_BUGON(pages[pagenr]);



		/*

		 * currently EROFS doesn't support multiref(dedup),

		 * so here erroring out one multiref page.

		 */

		if (pages[pagenr]) {

			DBG_BUGON(1);

			SetPageError(pages[pagenr]);

			z_erofs_onlinepage_endio(pages[pagenr]);

			err = -EIO;

		}

		pages[pagenr] = page;

	}

	sparsemem_pages = i;
@@ -889,7 +899,6 @@ static int z_erofs_vle_unzip(struct super_block *sb, 
	overlapped = false;

	compressed_pages = grp->compressed_pages;



	err = 0;

	for (i = 0; i < clusterpages; ++i) {

		unsigned pagenr;
@@ -915,7 +924,12 @@ static int z_erofs_vle_unzip(struct super_block *sb, 
			pagenr = z_erofs_onlinepage_index(page);



			DBG_BUGON(pagenr >= nr_pages);

			DBG_BUGON(pages[pagenr]);

			if (pages[pagenr]) {

				DBG_BUGON(1);

				SetPageError(pages[pagenr]);

				z_erofs_onlinepage_endio(pages[pagenr]);

				err = -EIO;

			}

			++sparsemem_pages;

			pages[pagenr] = page;