mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-09-27 21:03:32 +00:00
erofs: avoid infinite loop in z_erofs_do_read_page() when reading beyond EOF
[ Upstream commit8191213a58
] z_erofs_do_read_page() may loop infinitely due to the inappropriate truncation in the below statement. Since the offset is 64 bits and min_t() truncates the result to 32 bits. The solution is to replace unsigned int with a 64-bit type, such as erofs_off_t. cur = end - min_t(unsigned int, offset + end - map->m_la, end); - For example: - offset = 0x400160000 - end = 0x370 - map->m_la = 0x160370 - offset + end - map->m_la = 0x400000000 - offset + end - map->m_la = 0x00000000 (truncated as unsigned int) - Expected result: - cur = 0 - Actual result: - cur = 0x370 Signed-off-by: Chunhai Guo <guochunhai@vivo.com> Fixes:3883a79abd
("staging: erofs: introduce VLE decompression support") Reviewed-by: Gao Xiang <hsiangkao@linux.alibaba.com> Reviewed-by: Chao Yu <chao@kernel.org> Link: https://lore.kernel.org/r/20230710093410.44071-1-guochunhai@vivo.com Signed-off-by: Gao Xiang <hsiangkao@linux.alibaba.com> Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
parent
e649333bcf
commit
ed84618f8d
1 changed files with 1 additions and 1 deletions
|
@ -713,7 +713,7 @@ static int z_erofs_do_read_page(struct z_erofs_decompress_frontend *fe,
|
|||
tight &= (clt->mode >= COLLECT_PRIMARY_HOOKED &&
|
||||
clt->mode != COLLECT_PRIMARY_FOLLOWED_NOINPLACE);
|
||||
|
||||
cur = end - min_t(unsigned int, offset + end - map->m_la, end);
|
||||
cur = end - min_t(erofs_off_t, offset + end - map->m_la, end);
|
||||
if (!(map->m_flags & EROFS_MAP_MAPPED)) {
|
||||
zero_user_segment(page, cur, end);
|
||||
goto next_part;
|
||||
|
|
Loading…
Reference in a new issue