Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel
os
linux
Merge tag 'erofs-for-6.18-rc6-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/xiang/erofs
Pull erofs fixes from Gao Xiang:
- Add Chunhai Guo as a EROFS reviewer to get more eyes from interested
industry vendors
- Fix infinite loop caused by incomplete crafted zstd-compressed data
(thanks to Robert again!)
* tag 'erofs-for-6.18-rc6-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/xiang/erofs:
erofs: avoid infinite loop due to incomplete zstd-compressed data
MAINTAINERS: erofs: add myself as reviewer
+8
-4
+1
MAINTAINERS
+1
MAINTAINERS
···
9209
9209
R: Jeffle Xu <jefflexu@linux.alibaba.com>
9210
9210
R: Sandeep Dhavale <dhavale@google.com>
9211
9211
R: Hongbo Li <lihongbo22@huawei.com>
9212
+
R: Chunhai Guo <guochunhai@vivo.com>
9212
9213
L: linux-erofs@lists.ozlabs.org
9213
9214
S: Maintained
9214
9215
W: https://erofs.docs.kernel.org
+7
-4
fs/erofs/decompressor_zstd.c
+7
-4
fs/erofs/decompressor_zstd.c
···
172
172
dctx.bounce = strm->bounce;
173
173
174
174
do {
175
-
dctx.avail_out = out_buf.size - out_buf.pos;
176
175
dctx.inbuf_sz = in_buf.size;
177
176
dctx.inbuf_pos = in_buf.pos;
178
177
err = z_erofs_stream_switch_bufs(&dctx, &out_buf.dst,
···
187
188
in_buf.pos = dctx.inbuf_pos;
188
189
189
190
zerr = zstd_decompress_stream(stream, &out_buf, &in_buf);
190
-
if (zstd_is_error(zerr) || (!zerr && rq->outputsize)) {
191
+
dctx.avail_out = out_buf.size - out_buf.pos;
192
+
if (zstd_is_error(zerr) ||
193
+
((rq->outputsize + dctx.avail_out) && (!zerr || (zerr > 0 &&
194
+
!(rq->inputsize + in_buf.size - in_buf.pos))))) {
191
195
erofs_err(sb, "failed to decompress in[%u] out[%u]: %s",
192
196
rq->inputsize, rq->outputsize,
193
-
zerr ? zstd_get_error_name(zerr) : "unexpected end of stream");
197
+
zstd_is_error(zerr) ? zstd_get_error_name(zerr) :
198
+
"unexpected end of stream");
194
199
err = -EFSCORRUPTED;
195
200
break;
196
201
}
197
-
} while (rq->outputsize || out_buf.pos < out_buf.size);
202
+
} while (rq->outputsize + dctx.avail_out);
198
203
199
204
if (dctx.kout)
200
205
kunmap_local(dctx.kout);