| From c1b2028315c6b15e8d6725e0d5884b15887d3daa Mon Sep 17 00:00:00 2001 |
| From: Sean Nyekjaer <sean@geanix.com> |
| Date: Wed, 24 Mar 2021 21:37:32 -0700 |
| Subject: squashfs: fix inode lookup sanity checks |
| |
| From: Sean Nyekjaer <sean@geanix.com> |
| |
| commit c1b2028315c6b15e8d6725e0d5884b15887d3daa upstream. |
| |
| When mouting a squashfs image created without inode compression it fails |
| with: "unable to read inode lookup table" |
| |
| It turns out that the BLOCK_OFFSET is missing when checking the |
| SQUASHFS_METADATA_SIZE agaist the actual size. |
| |
| Link: https://lkml.kernel.org/r/20210226092903.1473545-1-sean@geanix.com |
| Fixes: eabac19e40c0 ("squashfs: add more sanity checks in inode lookup") |
| Signed-off-by: Sean Nyekjaer <sean@geanix.com> |
| Acked-by: Phillip Lougher <phillip@squashfs.org.uk> |
| Cc: <stable@vger.kernel.org> |
| Signed-off-by: Andrew Morton <akpm@linux-foundation.org> |
| Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| --- |
| fs/squashfs/export.c | 8 ++++++-- |
| fs/squashfs/squashfs_fs.h | 1 + |
| 2 files changed, 7 insertions(+), 2 deletions(-) |
| |
| --- a/fs/squashfs/export.c |
| +++ b/fs/squashfs/export.c |
| @@ -152,14 +152,18 @@ __le64 *squashfs_read_inode_lookup_table |
| start = le64_to_cpu(table[n]); |
| end = le64_to_cpu(table[n + 1]); |
| |
| - if (start >= end || (end - start) > SQUASHFS_METADATA_SIZE) { |
| + if (start >= end |
| + || (end - start) > |
| + (SQUASHFS_METADATA_SIZE + SQUASHFS_BLOCK_OFFSET)) { |
| kfree(table); |
| return ERR_PTR(-EINVAL); |
| } |
| } |
| |
| start = le64_to_cpu(table[indexes - 1]); |
| - if (start >= lookup_table_start || (lookup_table_start - start) > SQUASHFS_METADATA_SIZE) { |
| + if (start >= lookup_table_start || |
| + (lookup_table_start - start) > |
| + (SQUASHFS_METADATA_SIZE + SQUASHFS_BLOCK_OFFSET)) { |
| kfree(table); |
| return ERR_PTR(-EINVAL); |
| } |
| --- a/fs/squashfs/squashfs_fs.h |
| +++ b/fs/squashfs/squashfs_fs.h |
| @@ -17,6 +17,7 @@ |
| |
| /* size of metadata (inode and directory) blocks */ |
| #define SQUASHFS_METADATA_SIZE 8192 |
| +#define SQUASHFS_BLOCK_OFFSET 2 |
| |
| /* default size of block device I/O */ |
| #ifdef CONFIG_SQUASHFS_4K_DEVBLK_SIZE |
