Commit e12a0ce2 authored by Gao Xiang's avatar Gao Xiang Committed by Greg Kroah-Hartman
Browse files

staging: erofs: detect potential multiref due to corrupted images 



As reported by erofs-utils fuzzer, currently, multiref
(ondisk deduplication) hasn't been supported for now,
we should forbid it properly.

Fixes: 3883a79a ("staging: erofs: introduce VLE decompression support")
Cc: <stable@vger.kernel.org> # 4.19+
Signed-off-by: default avatarGao Xiang <gaoxiang25@huawei.com>
Reviewed-by: default avatarChao Yu <yuchao0@huawei.com>
Link: https://lore.kernel.org/r/20190821140152.229648-1-gaoxiang25@huawei.com


Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 8467c3b4

drivers/staging/erofs/zdata.c

+17 −3
Original line number Diff line number Diff line
@@ -798,6 +798,7 @@ static int z_erofs_decompress_pcluster(struct super_block *sb, 
	for (i = 0; i < nr_pages; ++i)

		pages[i] = NULL;



	err = 0;

	z_erofs_pagevec_ctor_init(&ctor, Z_EROFS_NR_INLINE_PAGEVECS,

				  cl->pagevec, 0);
@@ -819,8 +820,17 @@ static int z_erofs_decompress_pcluster(struct super_block *sb, 
			pagenr = z_erofs_onlinepage_index(page);



		DBG_BUGON(pagenr >= nr_pages);

		DBG_BUGON(pages[pagenr]);



		/*

		 * currently EROFS doesn't support multiref(dedup),

		 * so here erroring out one multiref page.

		 */

		if (unlikely(pages[pagenr])) {

			DBG_BUGON(1);

			SetPageError(pages[pagenr]);

			z_erofs_onlinepage_endio(pages[pagenr]);

			err = -EFSCORRUPTED;

		}

		pages[pagenr] = page;

	}

	z_erofs_pagevec_ctor_exit(&ctor, true);
@@ -828,7 +838,6 @@ static int z_erofs_decompress_pcluster(struct super_block *sb, 
	overlapped = false;

	compressed_pages = pcl->compressed_pages;



	err = 0;

	for (i = 0; i < clusterpages; ++i) {

		unsigned int pagenr;
@@ -852,7 +861,12 @@ static int z_erofs_decompress_pcluster(struct super_block *sb, 
			pagenr = z_erofs_onlinepage_index(page);



			DBG_BUGON(pagenr >= nr_pages);

			DBG_BUGON(pages[pagenr]);

			if (unlikely(pages[pagenr])) {

				DBG_BUGON(1);

				SetPageError(pages[pagenr]);

				z_erofs_onlinepage_endio(pages[pagenr]);

				err = -EFSCORRUPTED;

			}

			pages[pagenr] = page;



			overlapped = true;