averello/linux-stable-mirror
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git synced 2026-09-22 09:34:56 +02:00
Code Issues Packages Projects Releases Wiki Activity

erofs: fix "BUG: Bad page state in z_erofs_do_read_page"

Browse Source 
It's actually a stable-only issue from backporting 9e2f9d34dd
("erofs: handle overlapped pclusters out of crafted images properly")

We missed to update `oldpage` after `pcl->compressed_bvecs[nr].page`
is updated, so that the following cmpxchg() will fail; the original
upstream commit doesn't behave like this due to new features and
refactoring.

This backport issue only impacts some specific crafted images and
normal filesystems won't be impacted at all.

Fixes: 1bf7e414ca ("erofs: handle overlapped pclusters out of crafted images properly") # 6.6.y
Closes: https://syzkaller.appspot.com/bug?extid=b6353e35ae2bab997538
Reported-and-tested-by: syzbot+b6353e35ae2bab997538@syzkaller.appspotmail.com [1]
[1] https://lore.kernel.org/r/69c3b299.a70a0220.234938.004b.GAE@google.com
Signed-off-by: Gao Xiang <hsiangkao@linux.alibaba.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Gao Xiang
2026-04-02 13:07:31 +02:00
committed by Greg Kroah-Hartman
parent 75669e9871
commit cfadf46a67
1 changed files with 1 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
fs/erofs/zdata.c
+1
View File
@@ -1503,6 +1503,7 @@ repeat:
lock_page(page);
if (likely(page->mapping == mc)) {
WRITE_ONCE(pcl->compressed_bvecs[nr].page, page);
oldpage = page;
/*
* The cached folio is still in managed cache but without