erofs: fix inconsistent per-file compression format

[ Upstream commit 118a8cf504d7dfa519562d000f423ee3ca75d2c4 ]

EROFS can select compression algorithms on a per-file basis, and each
per-file compression algorithm needs to be marked in the on-disk
superblock for initialization.

However, syzkaller can generate inconsistent crafted images that use
an unsupported algorithmtype for specific inodes, e.g. use MicroLZMA
algorithmtype even it's not set in `sbi->available_compr_algs`.  This
can lead to an unexpected "BUG: kernel NULL pointer dereference" if
the corresponding decompressor isn't built-in.

Fix this by checking against `sbi->available_compr_algs` for each
m_algorithmformat request.  Incorrect !erofs_sb_has_compr_cfgs preset
bitmap is now fixed together since it was harmless previously.

Reported-by: <bugreport@ubisectech.com>
Fixes: 8f89926290c4 ("erofs: get compression algorithms directly on mapping")
Fixes: 622ceaddb764 ("erofs: lzma compression support")
Reviewed-by: Yue Hu <huyue2@coolpad.com>
Link: https://lore.kernel.org/r/20240113150602.1471050-1-hsiangkao@linux.alibaba.com
Signed-off-by: Gao Xiang <hsiangkao@linux.alibaba.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/fs/erofs/decompressor.c b/fs/erofs/decompressor.c
index e75edc8f17539b34577908c409bc9db04b33865f..8d1f86487d6e9c878ecbddb58343cbbc61885d29 100644 (file)
--- a/fs/erofs/decompressor.c
+++ b/fs/erofs/decompressor.c
@@ -399,7 +399,7 @@ int z_erofs_parse_cfgs(struct super_block *sb, struct erofs_super_block *dsb)
        int size, ret = 0;
 
        if (!erofs_sb_has_compr_cfgs(sbi)) {
-               sbi->available_compr_algs = Z_EROFS_COMPRESSION_LZ4;
+               sbi->available_compr_algs = 1 << Z_EROFS_COMPRESSION_LZ4;
                return z_erofs_load_lz4_config(sb, dsb, NULL, 0);
        }
 

diff --git a/fs/erofs/zmap.c b/fs/erofs/zmap.c
index 7b55111fd5337773555f6a78760b7e80cb95896a..7a1a24ae4a2d86f24b63e4341859d16ccd62c81f 100644 (file)
--- a/fs/erofs/zmap.c
+++ b/fs/erofs/zmap.c
@@ -458,7 +458,7 @@ static int z_erofs_do_map_blocks(struct inode *inode,
                .map = map,
        };
        int err = 0;
-       unsigned int lclusterbits, endoff;
+       unsigned int lclusterbits, endoff, afmt;
        unsigned long initial_lcn;
        unsigned long long ofs, end;
 
@@ -547,17 +547,20 @@ static int z_erofs_do_map_blocks(struct inode *inode,
                        err = -EFSCORRUPTED;
                        goto unmap_out;
                }
-               if (vi->z_advise & Z_EROFS_ADVISE_INTERLACED_PCLUSTER)
-                       map->m_algorithmformat =
-                               Z_EROFS_COMPRESSION_INTERLACED;
-               else
-                       map->m_algorithmformat =
-                               Z_EROFS_COMPRESSION_SHIFTED;
-       } else if (m.headtype == Z_EROFS_LCLUSTER_TYPE_HEAD2) {
-               map->m_algorithmformat = vi->z_algorithmtype[1];
+               afmt = vi->z_advise & Z_EROFS_ADVISE_INTERLACED_PCLUSTER ?
+                       Z_EROFS_COMPRESSION_INTERLACED :
+                       Z_EROFS_COMPRESSION_SHIFTED;
        } else {
-               map->m_algorithmformat = vi->z_algorithmtype[0];
+               afmt = m.headtype == Z_EROFS_LCLUSTER_TYPE_HEAD2 ?
+                       vi->z_algorithmtype[1] : vi->z_algorithmtype[0];
+               if (!(EROFS_I_SB(inode)->available_compr_algs & (1 << afmt))) {
+                       erofs_err(inode->i_sb, "inconsistent algorithmtype %u for nid %llu",
+                                 afmt, vi->nid);
+                       err = -EFSCORRUPTED;
+                       goto unmap_out;
+               }
        }
+       map->m_algorithmformat = afmt;
 
        if ((flags & EROFS_GET_BLOCKS_FIEMAP) ||
            ((flags & EROFS_GET_BLOCKS_READMORE) &&