Messages in this thread | | | Date | Mon, 10 Jul 2023 17:56:43 +0800 | Subject | Re: [PATCH] erofs: fix to avoid infinite loop in z_erofs_do_read_page() when read page beyond EOF | From | Gao Xiang <> |
| |
On 2023/7/10 17:34, Chunhai Guo wrote: > z_erofs_do_read_page() may loop infinitely due to the inappropriate > truncation in the below statement. Since the offset is 64 bits and min_t() > truncates the result to 32 bits. The solution is to replace unsigned int > with a 64-bit type, such as erofs_off_t. > cur = end - min_t(unsigned int, offset + end - map->m_la, end); > > - For example: > - offset = 0x400160000 > - end = 0x370 > - map->m_la = 0x160370 > - offset + end - map->m_la = 0x400000000 > - offset + end - map->m_la = 0x00000000 (truncated as unsigned int) > - Expected result: > - cur = 0 > - Actual result: > - cur = 0x370 > > Signed-off-by: Chunhai Guo <guochunhai@vivo.com>
I'd like to update the subject line manually to:
"erofs: avoid infinite loop in z_erofs_do_read_page() when reading beyond EOF"
since the original one is too long...
Otherwise it looks good to me,
Fixes: 3883a79abd02 ("staging: erofs: introduce VLE decompression support") Reviewed-by: Gao Xiang <hsiangkao@linux.alibaba.com>
Thanks, Gao Xiang
| |