[PATCH v2 1/4] fs: cramfs: don't ignore decompression errors

[Sascha Hauer]

cramfs_uncompress_block() returns -EIO when a block fails to
decompress, but cramfs_read_file() stores that in a size_t, so its
check for an error, curr_block_len <= 0, only catches empty blocks.
The error becomes a block length of nearly SIZE_MAX: the read copies
whatever priv->buf holds, the previous block or nothing that was ever
written, returns it as success, and keeps it cached as the content of
the failed block.

Store the length in an int, so that the error ends the read.

Fixes: b42f481fa4 ("reactivate cramfs")
Assisted-by: Claude:claude-opus-5-5
---
 fs/cramfs/cramfs.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/fs/cramfs/cramfs.c b/fs/cramfs/cramfs.c
index d66cce8df8..fcb9aeeab8 100644
--- a/fs/cramfs/cramfs.c
+++ b/fs/cramfs/cramfs.c
@@ -46,7 +46,7 @@ struct cramfs_priv {
 	struct cramfs_super super;
 	int curr_base;
 	char buf[4096];
-	size_t curr_block_len;
+	int curr_block_len;
 	struct cdev *cdev;
 };
 
@@ -149,7 +149,7 @@ static int cramfs_read_file(struct inode *inode, unsigned long offset,
 			priv->curr_base = base;
 		}
 
-		copy = min(priv->curr_block_len, size);
+		copy = min_t(size_t, priv->curr_block_len, size);
 
 		memcpy(buf, priv->buf + ofs, copy);
 		ofs = 0;

-- 
2.47.3