[PATCH] erofs: fix to avoid infinite loop in z_erofs_do_read_page() when read page beyond EOF
Chao Yu
chao at kernel.org
Wed Jul 12 00:13:06 AEST 2023
On 2023/7/10 17:34, Chunhai Guo wrote:
> z_erofs_do_read_page() may loop infinitely due to the inappropriate
> truncation in the below statement. Since the offset is 64 bits and min_t()
> truncates the result to 32 bits. The solution is to replace unsigned int
> with a 64-bit type, such as erofs_off_t.
> cur = end - min_t(unsigned int, offset + end - map->m_la, end);
>
> - For example:
> - offset = 0x400160000
> - end = 0x370
> - map->m_la = 0x160370
> - offset + end - map->m_la = 0x400000000
> - offset + end - map->m_la = 0x00000000 (truncated as unsigned int)
> - Expected result:
> - cur = 0
> - Actual result:
> - cur = 0x370
>
> Signed-off-by: Chunhai Guo <guochunhai at vivo.com>
Reviewed-by: Chao Yu <chao at kernel.org>
Thanks,
More information about the Linux-erofs
mailing list