diff options
author | Chunhai Guo <guochunhai@vivo.com> | 2023-07-10 12:34:10 +0300 |
---|---|---|
committer | Gao Xiang <hsiangkao@linux.alibaba.com> | 2023-07-11 19:50:43 +0300 |
commit | 8191213a5835b0317c5e4d0d337ae1ae00c75253 (patch) | |
tree | fefb3135be3bc2bceab6a4543d2a78aa1896d553 /fs/ocfs2 | |
parent | 936aa701d82d397c2d1afcd18ce2c739471d978d (diff) | |
download | linux-8191213a5835b0317c5e4d0d337ae1ae00c75253.tar.xz |
erofs: avoid infinite loop in z_erofs_do_read_page() when reading beyond EOF
z_erofs_do_read_page() may loop infinitely due to the inappropriate
truncation in the below statement. Since the offset is 64 bits and min_t()
truncates the result to 32 bits. The solution is to replace unsigned int
with a 64-bit type, such as erofs_off_t.
cur = end - min_t(unsigned int, offset + end - map->m_la, end);
- For example:
- offset = 0x400160000
- end = 0x370
- map->m_la = 0x160370
- offset + end - map->m_la = 0x400000000
- offset + end - map->m_la = 0x00000000 (truncated as unsigned int)
- Expected result:
- cur = 0
- Actual result:
- cur = 0x370
Signed-off-by: Chunhai Guo <guochunhai@vivo.com>
Fixes: 3883a79abd02 ("staging: erofs: introduce VLE decompression support")
Reviewed-by: Gao Xiang <hsiangkao@linux.alibaba.com>
Reviewed-by: Chao Yu <chao@kernel.org>
Link: https://lore.kernel.org/r/20230710093410.44071-1-guochunhai@vivo.com
Signed-off-by: Gao Xiang <hsiangkao@linux.alibaba.com>
Diffstat (limited to 'fs/ocfs2')
0 files changed, 0 insertions, 0 deletions