Phillip LougherandGreg Kroah-Hartman 984ed0567f Squashfs: fix variable overflow triggered by sysbot ...

[ Upstream commit 12427de943 ]

Sysbot reports a slab out of bounds write in squashfs_readahead().

This is ultimately caused by a file reporting an (infeasibly) large file
size (1407374883553280 bytes) with the minimum block size of 4K.

This causes variable overflow.

Link: https://lkml.kernel.org/r/20231113160901.6444-1-phillip@squashfs.org.uk
Signed-off-by: Phillip Lougher <phillip@squashfs.org.uk>
Reported-by: syzbot+604424eb051c2f696163@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/all/000000000000b1fda20609ede0d1@google.com/
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>

2024-08-19 06:04:26 +02:00

..

block.c

squashfs: squashfs_read_data need to check if the length is 0

2024-08-19 06:04:26 +02:00

cache.c

…

decompressor_multi_percpu.c

…

decompressor_multi.c

…

decompressor_single.c

…

decompressor.c

…

decompressor.h

…

dir.c

…

export.c

…

file_cache.c

…

file_direct.c

Squashfs: fix variable overflow triggered by sysbot

2024-08-19 06:04:26 +02:00

file.c

Squashfs: fix variable overflow triggered by sysbot

2024-08-19 06:04:26 +02:00

fragment.c

…

id.c

…

inode.c

Squashfs: check the inode number is not the invalid value of zero

2024-05-02 16:32:41 +02:00

Kconfig

…

lz4_wrapper.c

…

lzo_wrapper.c

…

Makefile

…

namei.c

…

page_actor.c

…

page_actor.h

…

squashfs_fs_i.h

…

squashfs_fs_sb.h

…

squashfs_fs.h

…

squashfs.h

…

super.c

…

symlink.c

…

xattr_id.c

…

xattr.c

…

xattr.h

…

xz_wrapper.c

…

zlib_wrapper.c

…

zstd_wrapper.c

…