Re: [PATCH] erofs: fix to avoid infinite loop in z_erofs_do_read_page() when read page beyond EOF

From: Chao Yu
Date: Tue Jul 11 2023 - 10:13:19 EST


On 2023/7/10 17:34, Chunhai Guo wrote:
z_erofs_do_read_page() may loop infinitely due to the inappropriate
truncation in the below statement. Since the offset is 64 bits and min_t()
truncates the result to 32 bits. The solution is to replace unsigned int
with a 64-bit type, such as erofs_off_t.
cur = end - min_t(unsigned int, offset + end - map->m_la, end);

- For example:
- offset = 0x400160000
- end = 0x370
- map->m_la = 0x160370
- offset + end - map->m_la = 0x400000000
- offset + end - map->m_la = 0x00000000 (truncated as unsigned int)
- Expected result:
- cur = 0
- Actual result:
- cur = 0x370

Signed-off-by: Chunhai Guo <guochunhai@xxxxxxxx>

Reviewed-by: Chao Yu <chao@xxxxxxxxxx>

Thanks,