erofs: fix out-of-bound read for shifted uncompressed block
authorGao Xiang <gaoxiang25@huawei.com>
Tue, 7 Jan 2020 02:25:46 +0000 (10:25 +0800)
committerGao Xiang <gaoxiang25@huawei.com>
Sat, 11 Jan 2020 10:29:19 +0000 (18:29 +0800)
commit4d2024370d877f9ac8b98694bcff666da6a5d333
tree33e0647654abdca047ab3584abc4a0b26378c84d
parente3915ad94bfa0e2c1818837af618e9adec74eb1b
erofs: fix out-of-bound read for shifted uncompressed block

rq->out[1] should be valid before accessing. Otherwise,
in very rare cases, out-of-bound dirty onstack rq->out[1]
can equal to *in and lead to unintended memmove behavior.

Link: https://lore.kernel.org/r/20200107022546.19432-1-gaoxiang25@huawei.com
Fixes: 7fc45dbc938a ("staging: erofs: introduce generic decompression backend")
Cc: <stable@vger.kernel.org> # 5.3+
Reviewed-by: Chao Yu <yuchao0@huawei.com>
Signed-off-by: Gao Xiang <gaoxiang25@huawei.com>
fs/erofs/decompressor.c