Kernel/linux-stable
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git synced 2024-12-29 09:16:33 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity
72e544b1b2
linux-stable/fs/squashfs
History
Fedor Pchelkin 72e544b1b2 squashfs: harden sanity check in squashfs_read_xattr_id_table 
While mounting a corrupted filesystem, a signed integer '*xattr_ids' can
become less than zero.  This leads to the incorrect computation of 'len'
and 'indexes' values which can cause null-ptr-deref in copy_bio_to_actor()
or out-of-bounds accesses in the next sanity checks inside
squashfs_read_xattr_id_table().

Found by Linux Verification Center (linuxtesting.org) with Syzkaller.

Link: https://lkml.kernel.org/r/20230117105226.329303-2-pchelkin@ispras.ru
Fixes: 506220d2ba ("squashfs: add more sanity checks in xattr id lookup")
Reported-by: <syzbot+082fa4af80a5bb1a9843@syzkaller.appspotmail.com>
Signed-off-by: Fedor Pchelkin <pchelkin@ispras.ru>
Signed-off-by: Alexey Khoroshilov <khoroshilov@ispras.ru>
Cc: Phillip Lougher <phillip@squashfs.org.uk>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2023-01-31 16:44:08 -08:00
..
block.c squashfs: add the mount parameter theads=<single|multi|percpu> 2022-11-18 13:55:08 -08:00
cache.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 35 2019-05-24 17:27:11 +02:00
decompressor_multi_percpu.c squashfs: add the mount parameter theads=<single|multi|percpu> 2022-11-18 13:55:08 -08:00
decompressor_multi.c squashfs: allows users to configure the number of decompression threads 2022-11-18 13:55:08 -08:00
decompressor_single.c squashfs: add the mount parameter theads=<single|multi|percpu> 2022-11-18 13:55:08 -08:00
decompressor.c squashfs: add the mount parameter theads=<single|multi|percpu> 2022-11-18 13:55:08 -08:00
decompressor.h squashfs: extend "page actor" to handle missing pages 2022-06-16 19:58:21 -07:00
dir.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 35 2019-05-24 17:27:11 +02:00
export.c squashfs: fix inode lookup sanity checks 2021-03-25 09:22:55 -07:00
file_cache.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 499 2019-06-19 17:09:53 +02:00
file_direct.c squashfs: don't call kmalloc in decompressors 2022-08-28 14:02:45 -07:00
file.c squashfs: fix buffer release race condition in readahead code 2022-10-28 13:37:21 -07:00
fragment.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 35 2019-05-24 17:27:11 +02:00
id.c squashfs: fix xattr id and id lookup sanity checks 2021-03-25 09:22:55 -07:00
inode.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 35 2019-05-24 17:27:11 +02:00
Kconfig squashfs: allows users to configure the number of decompression threads 2022-11-18 13:55:08 -08:00
lz4_wrapper.c squashfs: extend "page actor" to handle missing pages 2022-06-16 19:58:21 -07:00
lzo_wrapper.c squashfs: extend "page actor" to handle missing pages 2022-06-16 19:58:21 -07:00
Makefile squashfs: always build "file direct" version of page actor 2022-07-29 18:12:34 -07:00
namei.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 35 2019-05-24 17:27:11 +02:00
page_actor.c squashfs: fix read regression introduced in readahead code 2022-10-28 13:37:21 -07:00
page_actor.h squashfs: fix read regression introduced in readahead code 2022-10-28 13:37:21 -07:00
squashfs_fs_i.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 35 2019-05-24 17:27:11 +02:00
squashfs_fs_sb.h squashfs: allows users to configure the number of decompression threads 2022-11-18 13:55:08 -08:00
squashfs_fs.h squashfs: fix inode lookup sanity checks 2021-03-25 09:22:55 -07:00
squashfs.h squashfs: add the mount parameter theads=<single|multi|percpu> 2022-11-18 13:55:08 -08:00
super.c fs.idmapped.squashfs.v6.2 2022-12-12 20:24:51 -08:00
symlink.c squashfs: Convert squashfs to read_folio 2022-05-09 16:21:46 -04:00
xattr_id.c squashfs: harden sanity check in squashfs_read_xattr_id_table 2023-01-31 16:44:08 -08:00
xattr.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 35 2019-05-24 17:27:11 +02:00
xattr.h squashfs: add more sanity checks in id lookup 2021-02-09 17:26:44 -08:00
xz_wrapper.c squashfs: extend "page actor" to handle missing pages 2022-06-16 19:58:21 -07:00
zlib_wrapper.c squashfs: extend "page actor" to handle missing pages 2022-06-16 19:58:21 -07:00
zstd_wrapper.c squashfs: extend "page actor" to handle missing pages 2022-06-16 19:58:21 -07:00