[PATCH] erofs: fix unsigned underflow in LZ4 in-place decompression

[Liu Chao]

z_erofs_lz4_handle_overlap() computes the overlap offset between the
input and output page arrays as rq->outpages - rq->inpages.  Both
values are derived from on-disk pcluster metadata (pcl->length and
pcl->pclustersize) which an attacker can set independently, so
outpages may legitimately be smaller than inpages.  The unsigned
subtraction then underflows, causing rq->out[] to be indexed far out
of bounds and the returned LZ4 source pointer to point past the
output buffer, resulting in out-of-bounds reads and writes.

The in-place path is only valid when the output buffer is at least as
large as the input buffer, so guard the branch with
rq->outpages >= rq->inpages.  When the condition does not hold, fall
through to docopy, which copies the compressed data to the per-CPU
buffer and decompresses safely.

Reviewed-by: Fang Xieyan <fangxy@xxxxxxxxxxxx>
Signed-off-by: Liu Chao <liuc63@xxxxxxxxxxxx>
---
 fs/erofs/decompressor.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/fs/erofs/decompressor.c b/fs/erofs/decompressor.c
index 354762c97..50a5f9ddf 100644
--- a/fs/erofs/decompressor.c
+++ b/fs/erofs/decompressor.c
@@ -117,6 +117,7 @@ static void *z_erofs_lz4_handle_overlap(struct z_erofs_decompress_req *rq,
 		oend = rq->pageofs_out + rq->outputsize;
 		omargin = PAGE_ALIGN(oend) - oend;
 		if (rq->partial_decoding || !may_inplace ||
+		    rq->outpages < rq->inpages ||
 		    omargin < LZ4_DECOMPRESS_INPLACE_MARGIN(rq->inputsize))
 			goto docopy;
 
--
2.50.1