erofs ZTailpacking OOB

Vulnerability analysis

The EROFS filesystem parser fails to reject crafted images that combine ztailpacking with interlaced pclusters — a combination that valid formatting tools never produce but that an attacker can craft. When such an image is mounted and read, the decompression path computes an incorrect source offset, reading beyond the intended data and copying unrelated kernel memory into the page cache where userspace can observe it. The fix prevents ztailpacking mappings from being treated as interlaced and adds an alignment check so invalid images are rejected before any data is copied. Reaching this code requires mounting an EROFS image, which demands real root privileges; the image can be supplied via removable media or by a root user performing a manual mount.