Re: [PATCH 2/3] erofs-utils: lib: reject packed inodes in metabox

On 2026/5/12 15:33, Gao Xiang wrote:
>
>
> On 2026/5/12 15:16, Yifan Zhao wrote:
>> If packed_nid carries the metabox NID bit, loading the packed
>> inode first redirects its inode metadata lookup through the
>> metabox inode.  Initializing that metabox inode can then read
>> metadata that refers back through the packed inode, forming a
>> recursive packed inode -> metabox inode -> packed inode path.
>>
>> Reject such images while parsing the superblock, matching the
>> format rule that the special packed inode itself is not stored
>> inside the metabox.
>>
>> Reproducible image (base64-encoded gzipped blob):
>> H4sIAAAAAAAAA2NgGAWjYBSMVPDo4dcHrY0KwsxANg8jAwMLFjVMSGzPx/7Lzj3zXb3jSFTh
>> 5iN7v6CrbQSa8f8/gq8GoRpARHErYxYDEh8EVAm4jw2Il4AMFYDoB7IYmDGVNRhAzf8PBMh+
>> yEjNyclXKM8vyklRIILNRcA5o2AUjIJRMApGwSgYBaNgFAxpAGorv3VkYtBgQLSfQW3sF8wv
>> kJvZDSqIXkCDKpANlWxQZ2Bk0NPTS8RlPkgXqP0Oa5/DxNDNB7XvR8EoGAWjYBSMglEwCkbB
>> KBgFo2AUjIJRQBsAAEZO6n4AIAAA
>>
>> Assisted-by: Codex:GPT-5.5
>> Signed-off-by: Yifan Zhao <[email protected]>
>
> Can you fix the kernel instead first and backport to
> erofs-utils? like below,
>
OK. Should we do the same for [PATCH 1/3] too?


Thanks,

Yifan Zhao


> diff --git a/fs/erofs/super.c b/fs/erofs/super.c
> index 802add6652fd..d1829262c06e 100644
> --- a/fs/erofs/super.c
> +++ b/fs/erofs/super.c
> @@ -337,11 +337,12 @@ static int erofs_read_superblock(struct 
> super_block *sb)
>                                              metabox_nid))
>                         goto out;
>                 sbi->metabox_nid = le64_to_cpu(dsb->metabox_nid);
> -               if (sbi->metabox_nid & 
> BIT_ULL(EROFS_DIRENT_NID_METABOX_BIT))
> -                       goto out;               /* self-loop detection */
>         }
> -       sbi->inos = le64_to_cpu(dsb->inos);
> +       if ((sbi->metabox_nid | sbi->packed_nid) &
> +           BIT_ULL(EROFS_DIRENT_NID_METABOX_BIT))
> +               goto out;
>
> +       sbi->inos = le64_to_cpu(dsb->inos);
>         sbi->epoch = (s64)le64_to_cpu(dsb->epoch);
>         sbi->fixed_nsec = le32_to_cpu(dsb->fixed_nsec);
>         super_set_uuid(sb, (void *)dsb->uuid, sizeof(dsb->uuid));
>
> Thanks,
> Gao Xiang