e5099c0e85
commit f37aa4c7366e23f91b81d00bafd6a7ab54e4a381 upstream. Sysbot has reported a number of "slab-out-of-bounds reads" and "use-after-free read" errors which has been identified as being caused by a corrupted index value read from the inode. This could be because the metadata block is uncompressed, or because the "compression" bit has been corrupted (turning a compressed block into an uncompressed block). This patch adds additional sanity checks to detect this, and the following corruption. 1. It checks against corruption of the ids count. This can either lead to a larger table to be read, or a smaller than expected table to be read. In the case of a too large ids count, this would often have been trapped by the existing sanity checks, but this patch introduces a more exact check, which can identify too small values. 2. It checks the contents of the index table for corruption. Link: https://lkml.kernel.org/r/20210204130249.4495-3-phillip@squashfs.org.uk Signed-off-by: Phillip Lougher <phillip@squashfs.org.uk> Reported-by: syzbot+b06d57ba83f604522af2@syzkaller.appspotmail.com Reported-by: syzbot+c021ba012da41ee9807c@syzkaller.appspotmail.com Reported-by: syzbot+5024636e8b5fd19f0f19@syzkaller.appspotmail.com Reported-by: syzbot+bcbc661df46657d0fa4f@syzkaller.appspotmail.com Cc: <stable@vger.kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
55 lines
1.7 KiB
C
55 lines
1.7 KiB
C
/*
|
|
* Squashfs - a compressed read only filesystem for Linux
|
|
*
|
|
* Copyright (c) 2010
|
|
* Phillip Lougher <phillip@squashfs.org.uk>
|
|
*
|
|
* This program is free software; you can redistribute it and/or
|
|
* modify it under the terms of the GNU General Public License
|
|
* as published by the Free Software Foundation; either version 2,
|
|
* or (at your option) any later version.
|
|
*
|
|
* This program is distributed in the hope that it will be useful,
|
|
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
* GNU General Public License for more details.
|
|
*
|
|
* You should have received a copy of the GNU General Public License
|
|
* along with this program; if not, write to the Free Software
|
|
* Foundation, 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
|
|
*
|
|
* xattr.h
|
|
*/
|
|
|
|
#ifdef CONFIG_SQUASHFS_XATTR
|
|
extern __le64 *squashfs_read_xattr_id_table(struct super_block *, u64,
|
|
u64 *, int *);
|
|
extern int squashfs_xattr_lookup(struct super_block *, unsigned int, int *,
|
|
unsigned int *, unsigned long long *);
|
|
#else
|
|
static inline __le64 *squashfs_read_xattr_id_table(struct super_block *sb,
|
|
u64 start, u64 *xattr_table_start, int *xattr_ids)
|
|
{
|
|
struct squashfs_xattr_id_table *id_table;
|
|
|
|
id_table = squashfs_read_table(sb, start, sizeof(*id_table));
|
|
if (IS_ERR(id_table))
|
|
return (__le64 *) id_table;
|
|
|
|
*xattr_table_start = le64_to_cpu(id_table->xattr_table_start);
|
|
kfree(id_table);
|
|
|
|
ERROR("Xattrs in filesystem, these will be ignored\n");
|
|
return ERR_PTR(-ENOTSUPP);
|
|
}
|
|
|
|
static inline int squashfs_xattr_lookup(struct super_block *sb,
|
|
unsigned int index, int *count, unsigned int *size,
|
|
unsigned long long *xattr)
|
|
{
|
|
return 0;
|
|
}
|
|
#define squashfs_listxattr NULL
|
|
#define squashfs_xattr_handlers NULL
|
|
#endif
|