Re: [PATCH 2/3] erofs-utils: lib: reject packed inodes in metabox

On 2026/5/12 15:16, Yifan Zhao wrote:
> If packed_nid carries the metabox NID bit, loading the packed
> inode first redirects its inode metadata lookup through the
> metabox inode.  Initializing that metabox inode can then read
> metadata that refers back through the packed inode, forming a
> recursive packed inode -> metabox inode -> packed inode path.
> 
> Reject such images while parsing the superblock, matching the
> format rule that the special packed inode itself is not stored
> inside the metabox.
> 
> Reproducible image (base64-encoded gzipped blob):
> H4sIAAAAAAAAA2NgGAWjYBSMVPDo4dcHrY0KwsxANg8jAwMLFjVMSGzPx/7Lzj3zXb3jSFTh
> 5iN7v6CrbQSa8f8/gq8GoRpARHErYxYDEh8EVAm4jw2Il4AMFYDoB7IYmDGVNRhAzf8PBMh+
> yEjNyclXKM8vyklRIILNRcA5o2AUjIJRMApGwSgYBaNgFAxpAGorv3VkYtBgQLSfQW3sF8wv
> kJvZDSqIXkCDKpANlWxQZ2Bk0NPTS8RlPkgXqP0Oa5/DxNDNB7XvR8EoGAWjYBSMglEwCkbB
> KBgFo2AUjIJRQBsAAEZO6n4AIAAA
> 
> Assisted-by: Codex:GPT-5.5
> Signed-off-by: Yifan Zhao <[email protected]>

Can you fix the kernel instead first and backport to
erofs-utils? like below,

diff --git a/fs/erofs/super.c b/fs/erofs/super.c
index 802add6652fd..d1829262c06e 100644
--- a/fs/erofs/super.c
+++ b/fs/erofs/super.c
@@ -337,11 +337,12 @@ static int erofs_read_superblock(struct super_block *sb)
                                              metabox_nid))
                         goto out;
                 sbi->metabox_nid = le64_to_cpu(dsb->metabox_nid);
-               if (sbi->metabox_nid & BIT_ULL(EROFS_DIRENT_NID_METABOX_BIT))
-                       goto out;               /* self-loop detection */
         }
-       sbi->inos = le64_to_cpu(dsb->inos);
+       if ((sbi->metabox_nid | sbi->packed_nid) &
+           BIT_ULL(EROFS_DIRENT_NID_METABOX_BIT))
+               goto out;

+       sbi->inos = le64_to_cpu(dsb->inos);
         sbi->epoch = (s64)le64_to_cpu(dsb->epoch);
         sbi->fixed_nsec = le32_to_cpu(dsb->fixed_nsec);
         super_set_uuid(sb, (void *)dsb->uuid, sizeof(dsb->uuid));

Thanks,
Gao Xiang