syz reported a global-out-of-bounds Read in z_erofs_decompress_queue. OOB occurs in z_erofs_decompress_queue() because algorithmformat is too large.
Added relevant checks when registering pcluster. Reported-by: syzbot+5a398eb460ddaa6f2...@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=5a398eb460ddaa6f242f Tested-by: syzbot+5a398eb460ddaa6f2...@syzkaller.appspotmail.com Signed-off-by: Edward Adam Davis <eada...@qq.com> --- fs/erofs/zdata.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/fs/erofs/zdata.c b/fs/erofs/zdata.c index 2d73297003d2..085fa0685a57 100644 --- a/fs/erofs/zdata.c +++ b/fs/erofs/zdata.c @@ -762,6 +762,10 @@ static int z_erofs_register_pcluster(struct z_erofs_frontend *fe) pcl->from_meta = map->m_flags & EROFS_MAP_META; fe->mode = Z_EROFS_PCLUSTER_FOLLOWED; + if (pcl->algorithmformat >= Z_EROFS_COMPRESSION_MAX) { + err = -EINVAL; + goto out; + } /* * lock all primary followed works before visible to others * and mutex_trylock *never* fails for a new pcluster. @@ -796,6 +800,7 @@ static int z_erofs_register_pcluster(struct z_erofs_frontend *fe) err_out: mutex_unlock(&pcl->lock); +out: z_erofs_free_pcluster(pcl); return err; } -- 2.43.0
