erofs: fix out-of-bound read for shifted uncompressed block
authorGao Xiang <gaoxiang25@huawei.com>
Tue, 7 Jan 2020 02:25:46 +0000 (10:25 +0800)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Tue, 11 Feb 2020 12:35:23 +0000 (04:35 -0800)
commit3728834fff19f8adca9bbb1324f13e2be0704fea
treeec14e393c2d53c37d9abba8b8f67824f4fb08276
parent3ebbfdf41d268590350ff1ad11ec44f6d7e3b70e
erofs: fix out-of-bound read for shifted uncompressed block

commit 4d2024370d877f9ac8b98694bcff666da6a5d333 upstream.

rq->out[1] should be valid before accessing. Otherwise,
in very rare cases, out-of-bound dirty onstack rq->out[1]
can equal to *in and lead to unintended memmove behavior.

Link: https://lore.kernel.org/r/20200107022546.19432-1-gaoxiang25@huawei.com
Fixes: 7fc45dbc938a ("staging: erofs: introduce generic decompression backend")
Cc: <stable@vger.kernel.org> # 5.3+
Reviewed-by: Chao Yu <yuchao0@huawei.com>
Signed-off-by: Gao Xiang <gaoxiang25@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
fs/erofs/decompressor.c