hc
2024-02-20 102a0743326a03cd1a1202ceda21e175b7d3575c
kernel/fs/erofs/zmap.c
....@@ -192,6 +192,10 @@
192192 case Z_EROFS_VLE_CLUSTER_TYPE_PLAIN:
193193 case Z_EROFS_VLE_CLUSTER_TYPE_HEAD:
194194 m->clusterofs = le16_to_cpu(di->di_clusterofs);
195
+ if (m->clusterofs >= 1 << vi->z_logical_clusterbits) {
196
+ DBG_BUGON(1);
197
+ return -EFSCORRUPTED;
198
+ }
195199 m->pblk = le32_to_cpu(di->di_u.blkaddr);
196200 break;
197201 default:
....@@ -225,7 +229,7 @@
225229 u8 *in, type;
226230 bool big_pcluster;
227231
228
- if (1 << amortizedshift == 4)
232
+ if (1 << amortizedshift == 4 && lclusterbits <= 14)
229233 vcnt = 2;
230234 else if (1 << amortizedshift == 2 && lclusterbits == 12)
231235 vcnt = 16;
....@@ -318,7 +322,6 @@
318322 {
319323 struct inode *const inode = m->inode;
320324 struct erofs_inode *const vi = EROFS_I(inode);
321
- const unsigned int lclusterbits = vi->z_logical_clusterbits;
322325 const erofs_off_t ebase = ALIGN(iloc(EROFS_I_SB(inode), vi->nid) +
323326 vi->inode_isize + vi->xattr_isize, 8) +
324327 sizeof(struct z_erofs_map_header);
....@@ -327,9 +330,6 @@
327330 unsigned int amortizedshift;
328331 erofs_off_t pos;
329332 int err;
330
-
331
- if (lclusterbits != 12)
332
- return -EOPNOTSUPP;
333333
334334 if (lcn >= totalidx)
335335 return -EINVAL;