write in 30M

hc

2024-02-20 ea08eeccae9297f7aabd2ef7f0c2517ac4549acc

 kernel/fs/erofs/zmap.c
..
..
@@ -192,6 +192,10 @@
192
192
 	case Z_EROFS_VLE_CLUSTER_TYPE_PLAIN:
193
193
 	case Z_EROFS_VLE_CLUSTER_TYPE_HEAD:
194
194
 		m->clusterofs = le16_to_cpu(di->di_clusterofs);
195
+		if (m->clusterofs >= 1 << vi->z_logical_clusterbits) {
196
+			DBG_BUGON(1);
197
+			return -EFSCORRUPTED;
198
+		}
195
199
 		m->pblk = le32_to_cpu(di->di_u.blkaddr);
196
200
 		break;
197
201
 	default:
..
..
@@ -225,7 +229,7 @@
225
229
 	u8 *in, type;
226
230
 	bool big_pcluster;
227
231
 
228
-	if (1 << amortizedshift == 4)
232
+	if (1 << amortizedshift == 4 && lclusterbits <= 14)
229
233
 		vcnt = 2;
230
234
 	else if (1 << amortizedshift == 2 && lclusterbits == 12)
231
235
 		vcnt = 16;
..
..
@@ -318,7 +322,6 @@
318
322
 {
319
323
 	struct inode *const inode = m->inode;
320
324
 	struct erofs_inode *const vi = EROFS_I(inode);
321
-	const unsigned int lclusterbits = vi->z_logical_clusterbits;
322
325
 	const erofs_off_t ebase = ALIGN(iloc(EROFS_I_SB(inode), vi->nid) +
323
326
 					vi->inode_isize + vi->xattr_isize, 8) +
324
327
 		sizeof(struct z_erofs_map_header);
..
..
@@ -327,9 +330,6 @@
327
330
 	unsigned int amortizedshift;
328
331
 	erofs_off_t pos;
329
332
 	int err;
330
-
331
-	if (lclusterbits != 12)
332
-		return -EOPNOTSUPP;
333
333
 
334
334
 	if (lcn >= totalidx)
335
335
 		return -EINVAL;