Re: [PATCH v2 1/4] fs: cramfs: don't ignore decompression errors

["Sascha Hauer" <s.hauer@pengutronix.de>]

On 2026-11-02 10:31, Sascha Hauer wrote:
> cramfs_uncompress_block() returns -EIO when a block fails to
> decompress, but cramfs_read_file() stores that in a size_t, so its
> check for an error, curr_block_len <= 0, only catches empty blocks.
> The error becomes a block length of nearly SIZE_MAX: the read copies
> whatever priv->buf holds, the previous block or nothing that was ever
> written, returns it as success, and keeps it cached as the content of
> the failed block.
> 
> Store the length in an int, so that the error ends the read.
> 
> Fixes: b42f481fa4 ("reactivate cramfs")
> Assisted-by: Claude:claude-opus-5-5

Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>


> ---
>  fs/cramfs/cramfs.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/fs/cramfs/cramfs.c b/fs/cramfs/cramfs.c
> index d66cce8df8..fcb9aeeab8 100644
> --- a/fs/cramfs/cramfs.c
> +++ b/fs/cramfs/cramfs.c
> @@ -46,7 +46,7 @@ struct cramfs_priv {
>  	struct cramfs_super super;
>  	int curr_base;
>  	char buf[4096];
> -	size_t curr_block_len;
> +	int curr_block_len;
>  	struct cdev *cdev;
>  };
>  
> @@ -149,7 +149,7 @@ static int cramfs_read_file(struct inode *inode, unsigned long offset,
>  			priv->curr_base = base;
>  		}
>  
> -		copy = min(priv->curr_block_len, size);
> +		copy = min_t(size_t, priv->curr_block_len, size);
>  
>  		memcpy(buf, priv->buf + ofs, copy);
>  		ofs = 0;
> 
> -- 
> 2.47.3
> 

-- 
Pengutronix e.K.                           |                             |
Steuerwalder Str. 21                       | http://www.pengutronix.de/  |
31137 Hildesheim, Germany                  | Phone: +49-5121-206917-0    |
Amtsgericht Hildesheim, HRA 2686           | Fax:   +49-5121-206917-5555 |