mirror of
https://github.com/torvalds/linux.git
synced 2026-09-23 13:14:02 +02:00
135d84c66f
erofs_bread() locates the target folio with
index = (buf->off + offset) >> PAGE_SHIFT;
but computes the in-folio offset without taking buf->off into account:
return buf->base + (offset & ~PAGE_MASK);
If buf->off is not page-aligned, the returned pointer misses the in-page
component of buf->off, so callers end up fetching data from a wrong
offset.
buf->off is set to sbi->dif0.fsoff in erofs_init_metabuf(), and fsoff can
be specified via the "fsoffset=" mount option, which only requires
block-size alignment. Therefore, on an image with a sub-page block size
(e.g. 512 bytes), a non-page-aligned fsoff (e.g. 512) triggers the issue,
since 512 is a multiple of the block size but not of PAGE_SIZE.
It can be reproduced by mounting an image that is placed at a
non-page-aligned offset:
mkfs.erofs -b512 -zlz4hc sub.erofs src/
# prepend 512 bytes of padding to the image
mount -t erofs -o loop,fsoffset=512 padded.erofs /mnt
which fails with
erofs (device loop0): cannot find valid erofs superblock
because the on-disk superblock (at offset 1024 within the image, i.e.
1536 within the padded file) is read from a wrong in-folio offset. With
this fixed, the very same image mounts successfully and its file contents
match those read from the unpadded image.
Fix it by including buf->off in the in-folio offset calculation, so that
it is consistent with the folio index calculation.
Fixes:
|
||
|---|---|---|
| .. | ||
| compress.h | ||
| data.c | ||
| decompressor_crypto.c | ||
| decompressor_deflate.c | ||
| decompressor_lzma.c | ||
| decompressor_zstd.c | ||
| decompressor.c | ||
| dir.c | ||
| erofs_fs.h | ||
| fileio.c | ||
| inode.c | ||
| internal.h | ||
| ishare.c | ||
| Kconfig | ||
| Makefile | ||
| namei.c | ||
| super.c | ||
| sysfs.c | ||
| xattr.c | ||
| xattr.h | ||
| zdata.c | ||
| zmap.c | ||
| zutil.c | ||