Source kernel commit: 540787d38b10dbc16a7d2bc2845752ab1605403a Signed-off-by: Gao Xiang <hsiang...@linux.alibaba.com> --- lib/zmap.c | 22 +++++++--------------- 1 file changed, 7 insertions(+), 15 deletions(-)
diff --git a/lib/zmap.c b/lib/zmap.c index d47ed6b..07c6a83 100644 --- a/lib/zmap.c +++ b/lib/zmap.c @@ -493,6 +493,11 @@ static int z_erofs_do_map_blocks(struct erofs_inode *vi, map->m_flags |= EROFS_MAP_META; map->m_pa = vi->z_fragmentoff; map->m_plen = vi->z_idata_size; + if (erofs_blkoff(sbi, map->m_pa) + map->m_plen > erofs_blksiz(sbi)) { + erofs_err("invalid tail-packing pclustersize %llu", + map->m_plen | 0ULL); + goto out; + } } else if (fragment && m.lcn == vi->z_tailextent_headlcn) { map->m_flags |= EROFS_MAP_FRAGMENT; } else { @@ -589,21 +594,8 @@ static int z_erofs_fill_inode_lazy(struct erofs_inode *vi) return -EFSCORRUPTED; } - if (vi->z_idata_size) { - struct erofs_map_blocks map = { .index = UINT_MAX }; - - err = z_erofs_do_map_blocks(vi, &map, - EROFS_GET_BLOCKS_FINDTAIL); - if (erofs_blkoff(sbi, map.m_pa) + map.m_plen > erofs_blksiz(sbi)) { - erofs_err("invalid tail-packing pclustersize %llu", - map.m_plen | 0ULL); - return -EFSCORRUPTED; - } - if (err < 0) - return err; - } - if (vi->z_advise & Z_EROFS_ADVISE_FRAGMENT_PCLUSTER && - !(h->h_clusterbits >> Z_EROFS_FRAGMENT_INODE_BIT)) { + if (vi->z_idata_size || + (vi->z_advise & Z_EROFS_ADVISE_FRAGMENT_PCLUSTER)) { struct erofs_map_blocks map = { .index = UINT_MAX }; err = z_erofs_do_map_blocks(vi, &map, -- 2.43.5