kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-24 19:10:26 +00:00
Code Issues Releases Packages Activity
linux/fs/squashfs
History
Phillip Lougher 875fb3f87a Squashfs: reject negative file sizes in squashfs_read_inode() 
[ Upstream commit 9f1c14c1de ]

Syskaller reports a "WARNING in ovl_copy_up_file" in overlayfs.

This warning is ultimately caused because the underlying Squashfs file
system returns a file with a negative file size.

This commit checks for a negative file size and returns EINVAL.

[phillip@squashfs.org.uk: only need to check 64 bit quantity]
  Link: https://lkml.kernel.org/r/20250926222305.110103-1-phillip@squashfs.org.uk
Link: https://lkml.kernel.org/r/20250926215935.107233-1-phillip@squashfs.org.uk
Fixes: 6545b246a2 ("Squashfs: inode operations")
Signed-off-by: Phillip Lougher <phillip@squashfs.org.uk>
Reported-by: syzbot+f754e01116421e9754b9@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/all/68d580e5.a00a0220.303701.0019.GAE@google.com/
Cc: Amir Goldstein <amir73il@gmail.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
History 2025-10-19 16:34:00 +02:00
..
block.c squashfs: squashfs_read_data need to check if the length is 0 2023-12-06 16:12:45 -08:00
cache.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 35 2019-05-24 17:27:11 +02:00
decompressor.c squashfs: don't include buffer_head.h 2023-06-09 17:44:14 -07:00
decompressor.h squashfs: extend "page actor" to handle missing pages 2022-06-16 19:58:21 -07:00
decompressor_multi.c squashfs: allows users to configure the number of decompression threads 2022-11-18 13:55:08 -08:00
decompressor_multi_percpu.c squashfs: fix percpu address space issues in decompressor_multi_percpu.c 2024-09-09 16:47:41 -07:00
decompressor_single.c squashfs: add the mount parameter theads=<single|multi|percpu> 2022-11-18 13:55:08 -08:00
dir.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 35 2019-05-24 17:27:11 +02:00
export.c exportfs: make ->encode_fh() a mandatory method for NFS export 2023-10-28 16:15:15 +02:00
file.c Squashfs: Ensure all readahead pages have been used 2024-08-23 13:11:36 +02:00
file_cache.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 499 2019-06-19 17:09:53 +02:00
file_direct.c Squashfs: fix variable overflow in squashfs_readpage_block 2024-10-30 20:14:12 -07:00
fragment.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 35 2019-05-24 17:27:11 +02:00
id.c squashfs: fix xattr id and id lookup sanity checks 2021-03-25 09:22:55 -07:00
inode.c Squashfs: reject negative file sizes in squashfs_read_inode() 2025-10-19 16:34:00 +02:00
Kconfig squashfs: allows users to configure the number of decompression threads 2022-11-18 13:55:08 -08:00
lz4_wrapper.c squashfs: extend "page actor" to handle missing pages 2022-06-16 19:58:21 -07:00
lzo_wrapper.c squashfs: extend "page actor" to handle missing pages 2022-06-16 19:58:21 -07:00
Makefile squashfs: always build "file direct" version of page actor 2022-07-29 18:12:34 -07:00
namei.c Squashfs: remove deprecated strncpy by not copying the string 2024-04-25 21:07:05 -07:00
page_actor.c Squashfs: Update page_actor to not use page->index 2024-08-19 14:08:20 +02:00
page_actor.h Squashfs: Ensure all readahead pages have been used 2024-08-23 13:11:36 +02:00
squashfs.h squashfs: move squashfs_xattr_handlers to .rodata 2023-10-10 13:49:20 +02:00
squashfs_fs.h Squashfs: fix handling and sanity checking of xattr_ids count 2023-01-31 16:44:10 -08:00
squashfs_fs_i.h Squashfs: fix uninit-value in squashfs_get_parent 2025-10-15 12:00:20 +02:00
squashfs_fs_sb.h squashfs: cache partial compressed blocks 2023-06-09 17:44:14 -07:00
super.c squashfs: fix memory leak in squashfs_fill_super 2025-08-28 16:31:05 +02:00
symlink.c squashfs: convert squashfs_symlink_read_folio to use folio APIs 2024-05-08 08:41:28 -07:00
xattr.c squashfs: move squashfs_xattr_handlers to .rodata 2023-10-10 13:49:20 +02:00
xattr.h Squashfs: fix handling and sanity checking of xattr_ids count 2023-01-31 16:44:10 -08:00
xattr_id.c revert "squashfs: harden sanity check in squashfs_read_xattr_id_table" 2023-02-03 17:52:25 -08:00
xz_wrapper.c squashfs: extend "page actor" to handle missing pages 2022-06-16 19:58:21 -07:00
zlib_wrapper.c squashfs: extend "page actor" to handle missing pages 2022-06-16 19:58:21 -07:00
zstd_wrapper.c squashfs: extend "page actor" to handle missing pages 2022-06-16 19:58:21 -07:00