linux-kernel - Re: [syzbot] [erofs?] KASAN: global-out-of-bounds Read in z_erofs_decompress

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <tencent_2BECEECECC7B926C782CC96EB897BCE8DE0A@qq.com>
Date: Sat, 23 Aug 2025 08:53:53 +0800
From: Edward Adam Davis <eadavis@...com>
To: syzbot+5a398eb460ddaa6f242f@...kaller.appspotmail.com
Cc: linux-kernel@...r.kernel.org,
	syzkaller-bugs@...glegroups.com
Subject: Re: [syzbot] [erofs?] KASAN: global-out-of-bounds Read in z_erofs_decompress_queue

#syz test

diff --git a/fs/erofs/zdata.c b/fs/erofs/zdata.c
index 2d73297003d2..11f59bc2db8e 100644
--- a/fs/erofs/zdata.c
+++ b/fs/erofs/zdata.c
@@ -752,6 +752,10 @@ static int z_erofs_register_pcluster(struct z_erofs_frontend *fe)
 
 	lockref_init(&pcl->lockref); /* one ref for this request */
 	pcl->algorithmformat = map->m_algorithmformat;
+	if (pcl->algorithmformat >= Z_EROFS_COMPRESSION_MAX) {
+		err = -EINVAL;
+		goto out;
+	}
 	pcl->pclustersize = map->m_plen;
 	pcl->length = 0;
 	pcl->partial = true;
@@ -796,6 +800,7 @@ static int z_erofs_register_pcluster(struct z_erofs_frontend *fe)
 
 err_out:
 	mutex_unlock(&pcl->lock);
+out:
 	z_erofs_free_pcluster(pcl);
 	return err;
 }