Patch "erofs: fix incorrect symlink detection in fast symlink" has been added to the 6.10-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    erofs: fix incorrect symlink detection in fast symlink

to the 6.10-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     erofs-fix-incorrect-symlink-detection-in-fast-symlin.patch
and it can be found in the queue-6.10 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 840d196f6fffab31bd7b90d3602b4ed8b47efa71
Author: Gao Xiang <xiang@xxxxxxxxxx>
Date:   Mon Sep 9 11:19:11 2024 +0800

    erofs: fix incorrect symlink detection in fast symlink
    
    [ Upstream commit 9ed50b8231e37b1ae863f5dec8153b98d9f389b4 ]
    
    Fast symlink can be used if the on-disk symlink data is stored
    in the same block as the on-disk inode, so we don’t need to trigger
    another I/O for symlink data.  However, currently fs correction could be
    reported _incorrectly_ if inode xattrs are too large.
    
    In fact, these should be valid images although they cannot be handled as
    fast symlinks.
    
    Many thanks to Colin for reporting this!
    
    Reported-by: Colin Walters <walters@xxxxxxxxxx>
    Reported-by: https://honggfuzz.dev/
    Link: https://lore.kernel.org/r/bb2dd430-7de0-47da-ae5b-82ab2dd4d945@xxxxxxxxxxxxxxxx
    Fixes: 431339ba9042 ("staging: erofs: add inode operations")
    [ Note that it's a runtime misbehavior instead of a security issue. ]
    Signed-off-by: Gao Xiang <hsiangkao@xxxxxxxxxxxxxxxxx>
    Link: https://lore.kernel.org/r/20240909031911.1174718-1-hsiangkao@xxxxxxxxxxxxxxxxx
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/fs/erofs/inode.c b/fs/erofs/inode.c
index 5f6439a63af79..f2cab9e4f3bcd 100644
--- a/fs/erofs/inode.c
+++ b/fs/erofs/inode.c
@@ -178,12 +178,14 @@ static int erofs_fill_symlink(struct inode *inode, void *kaddr,
 			      unsigned int m_pofs)
 {
 	struct erofs_inode *vi = EROFS_I(inode);
-	unsigned int bsz = i_blocksize(inode);
+	loff_t off;
 	char *lnk;
 
-	/* if it cannot be handled with fast symlink scheme */
-	if (vi->datalayout != EROFS_INODE_FLAT_INLINE ||
-	    inode->i_size >= bsz || inode->i_size < 0) {
+	m_pofs += vi->xattr_isize;
+	/* check if it cannot be handled with fast symlink scheme */
+	if (vi->datalayout != EROFS_INODE_FLAT_INLINE || inode->i_size < 0 ||
+	    check_add_overflow(m_pofs, inode->i_size, &off) ||
+	    off > i_blocksize(inode)) {
 		inode->i_op = &erofs_symlink_iops;
 		return 0;
 	}
@@ -192,16 +194,6 @@ static int erofs_fill_symlink(struct inode *inode, void *kaddr,
 	if (!lnk)
 		return -ENOMEM;
 
-	m_pofs += vi->xattr_isize;
-	/* inline symlink data shouldn't cross block boundary */
-	if (m_pofs + inode->i_size > bsz) {
-		kfree(lnk);
-		erofs_err(inode->i_sb,
-			  "inline data cross block boundary @ nid %llu",
-			  vi->nid);
-		DBG_BUGON(1);
-		return -EFSCORRUPTED;
-	}
 	memcpy(lnk, kaddr + m_pofs, inode->i_size);
 	lnk[inode->i_size] = '\0';