diff options
| author | Phillip Lougher <phillip@squashfs.org.uk> | 2026-02-17 05:09:55 +0000 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2026-03-13 17:20:35 +0100 |
| commit | 9e9fa5ad37c9cbad73c165c7ff1e76e650825e7c (patch) | |
| tree | 633f1a89a4e2c59c2576569a4fa55bea4be2cf1b /fs/squashfs | |
| parent | 4fcfa424a581d823cb1a9676e3eefe6ca17e453a (diff) | |
| download | linux-9e9fa5ad37c9cbad73c165c7ff1e76e650825e7c.tar.gz linux-9e9fa5ad37c9cbad73c165c7ff1e76e650825e7c.tar.bz2 linux-9e9fa5ad37c9cbad73c165c7ff1e76e650825e7c.zip | |
Squashfs: check metadata block offset is within range
commit fdb24a820a5832ec4532273282cbd4f22c291a0d upstream.
Syzkaller reports a "general protection fault in squashfs_copy_data"
This is ultimately caused by a corrupted index look-up table, which
produces a negative metadata block offset.
This is subsequently passed to squashfs_copy_data (via
squashfs_read_metadata) where the negative offset causes an out of bounds
access.
The fix is to check that the offset is within range in
squashfs_read_metadata. This will trap this and other cases.
Link: https://lkml.kernel.org/r/20260217050955.138351-1-phillip@squashfs.org.uk
Fixes: f400e12656ab ("Squashfs: cache operations")
Reported-by: syzbot+a9747fe1c35a5b115d3f@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/all/699234e2.a70a0220.2c38d7.00e2.GAE@google.com/
Signed-off-by: Phillip Lougher <phillip@squashfs.org.uk>
Cc: Christian Brauner <brauner@kernel.org>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'fs/squashfs')
| -rw-r--r-- | fs/squashfs/cache.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/fs/squashfs/cache.c b/fs/squashfs/cache.c index 5062326d0efb..25bf038b880a 100644 --- a/fs/squashfs/cache.c +++ b/fs/squashfs/cache.c @@ -340,6 +340,9 @@ int squashfs_read_metadata(struct super_block *sb, void *buffer, if (unlikely(length < 0)) return -EIO; + if (unlikely(*offset < 0 || *offset >= SQUASHFS_METADATA_SIZE)) + return -EIO; + while (length) { entry = squashfs_cache_get(sb, msblk->block_cache, *block, 0); if (entry->error) { |