erofs ExtentMap OOB

Vulnerability analysis

The vulnerability occurs in EROFS extent mapping logic where plain data extents with unaligned physical lengths are incorrectly classified as interlaced plain extents instead of shifted plain extents. The root cause is insufficient alignment validation - the code only checked if the physical address was block-aligned but failed to verify that both the physical address AND physical length were aligned. This misclassification causes z_erofs_transform_plain() to perform out-of-bounds reads when processing the extent data. The fix adds proper validation by checking both map->m_pa and map->m_plen against the block mask before classifying as interlaced format. Attack surface is local-only, requiring ability to mount filesystems (typically CAP_SYS_ADMIN or equivalent mount privileges).