Re: [PATCH v2] erofs: fix metadata reads at the end of file-backed images

[Gao Xiang]

On Fri, Oct 23, 2026 at 03:00:51PM -0400, Hengyu Liang wrote:
> Commit e587a984d332 ("erofs: use dedicated meta inodes for file-backed
> mounts") made erofs_read_meta_folio() read the metadata of a
> file-backed mount one whole folio at a time.
> 
> However, an image only has to be a multiple of its block size. With a
> block size below the page size, it can end in the middle of a page. The
> read of that last page is then short, and erofs_fileio_ki_complete()
> fails it with -EIO. As of now, inodes in the last page of such an image
> cannot be read, and an image smaller than a page cannot be mounted.
> 
> The issue can be reproduced with util-linux 2.41, whose mount uses the
> image file directly:
> 
>     mkdir src
>     for i in $(seq 50); do echo $i > src/$i; done
>     mkfs.erofs -b512 test.erofs src
>     mount -t erofs test.erofs /mnt
>     ls -l /mnt
> 
> Before that commit, ls -l lists all 50 files. After it, ls -l reports
> "Input/output error" for 24 of them.
> 
> This patch reads the folio only up to the end of the backing file and
> zeroes the rest, as the page cache of the backing file did before. A
> folio that lies wholly past the end is zeroed without a read.
> 
> Fixes: e587a984d332 ("erofs: use dedicated meta inodes for file-backed mounts")
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Hengyu Liang <hengyul@xxxxxxxxxx>
> ---
> Changes in v2:
> - Also zero a folio that lies wholly past the end of the backing file,
>   without a read, as suggested by Gao Xiang.
> - v1: https://lore.kernel.org/r/20261023174232.3282900-1-hengyul@xxxxxxxxxx
> 
> Tested in KVM with KASAN on 734bef548a96: the images used for v1, plus
> three images cut so that whole folios lie past the end. With this
> patch every complete image reads back correctly, and the cut images
> give the same results as v7.2 (EFSCORRUPTED instead of EIO for the
> inodes past the end).
> 
>  fs/erofs/fileio.c | 19 ++++++++++++++++---
>  1 file changed, 16 insertions(+), 3 deletions(-)
> 
> diff --git a/fs/erofs/fileio.c b/fs/erofs/fileio.c
> index c36a90a1a4cb..a77af604479f 100644
> --- a/fs/erofs/fileio.c
> +++ b/fs/erofs/fileio.c
> @@ -142,17 +142,30 @@ int erofs_read_meta_folio(struct file *file, struct folio *folio)
>  		.dev = { .m_pa = folio_pos(folio), },
>  	};
>  	struct inode *inode = folio_inode(folio);
> +	size_t len = folio_size(folio);
> +	loff_t pos, isize;
>  	int err;
>  
>  	err = erofs_map_dev(inode->i_sb, &io.dev);
>  	if (err)
>  		return err;
>  
> +	pos = io.dev.m_dif->fsoff + io.dev.m_pa;
> +	isize = i_size_read(file_inode(io.dev.m_dif->file));
> +	/* the image may end before the end of the folio, zero the rest */

I dropped this obvious comment, otherwise it looks good to me:

Reviewed-by: Gao Xiang <xiang@xxxxxxxxxx>

Thanks,
Gao Xiang