From cfadf46a67b6810db4d4de83778341b28509a222 Mon Sep 17 00:00:00 2001 From: Gao Xiang Date: Fri, 27 Mar 2026 12:15:24 +0800 Subject: [PATCH] erofs: fix "BUG: Bad page state in z_erofs_do_read_page" It's actually a stable-only issue from backporting 9e2f9d34dd12 ("erofs: handle overlapped pclusters out of crafted images properly") We missed to update `oldpage` after `pcl->compressed_bvecs[nr].page` is updated, so that the following cmpxchg() will fail; the original upstream commit doesn't behave like this due to new features and refactoring. This backport issue only impacts some specific crafted images and normal filesystems won't be impacted at all. Fixes: 1bf7e414cac3 ("erofs: handle overlapped pclusters out of crafted images properly") # 6.6.y Closes: https://syzkaller.appspot.com/bug?extid=b6353e35ae2bab997538 Reported-and-tested-by: syzbot+b6353e35ae2bab997538@syzkaller.appspotmail.com [1] [1] https://lore.kernel.org/r/69c3b299.a70a0220.234938.004b.GAE@google.com Signed-off-by: Gao Xiang Signed-off-by: Greg Kroah-Hartman --- fs/erofs/zdata.c | 1 + 1 file changed, 1 insertion(+) diff --git a/fs/erofs/zdata.c b/fs/erofs/zdata.c index 27a025968297..5b3eb4a22793 100644 --- a/fs/erofs/zdata.c +++ b/fs/erofs/zdata.c @@ -1503,6 +1503,7 @@ repeat: lock_page(page); if (likely(page->mapping == mc)) { WRITE_ONCE(pcl->compressed_bvecs[nr].page, page); + oldpage = page; /* * The cached folio is still in managed cache but without