1
0
mirror of https://github.com/torvalds/linux.git synced 2024-12-19 17:41:29 +00:00
linux/fs/squashfs
Phillip Lougher d31638ff6c Squashfs: fix variable overflow in squashfs_readpage_block
Syzbot reports a slab out of bounds access in squashfs_readpage_block().

This is caused by an attempt to read page index 0x2000000000.  This value
(start_index) is stored in an integer loop variable which overflows
producing a value of 0.  This causes a loop which iterates over pages
start_index -> end_index to iterate over 0 -> end_index, which ultimately
causes an out of bounds page array access.

Fix by changing variable to a loff_t, and rename to index to make it
clearer it is a page index, and not a loop count.

Link: https://lkml.kernel.org/r/20241020232200.837231-1-phillip@squashfs.org.uk
Signed-off-by: Phillip Lougher <phillip@squashfs.org.uk>
Reported-by: "Lai, Yi" <yi1.lai@linux.intel.com>
Closes: https://lore.kernel.org/all/ZwzcnCAosIPqQ9Ie@ly-workstation/
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2024-10-30 20:14:12 -07:00
..
block.c squashfs: squashfs_read_data need to check if the length is 0 2023-12-06 16:12:45 -08:00
cache.c
decompressor_multi_percpu.c squashfs: fix percpu address space issues in decompressor_multi_percpu.c 2024-09-09 16:47:41 -07:00
decompressor_multi.c squashfs: allows users to configure the number of decompression threads 2022-11-18 13:55:08 -08:00
decompressor_single.c squashfs: add the mount parameter theads=<single|multi|percpu> 2022-11-18 13:55:08 -08:00
decompressor.c squashfs: don't include buffer_head.h 2023-06-09 17:44:14 -07:00
decompressor.h squashfs: extend "page actor" to handle missing pages 2022-06-16 19:58:21 -07:00
dir.c
export.c exportfs: make ->encode_fh() a mandatory method for NFS export 2023-10-28 16:15:15 +02:00
file_cache.c
file_direct.c Squashfs: fix variable overflow in squashfs_readpage_block 2024-10-30 20:14:12 -07:00
file.c Squashfs: Ensure all readahead pages have been used 2024-08-23 13:11:36 +02:00
fragment.c
id.c squashfs: fix xattr id and id lookup sanity checks 2021-03-25 09:22:55 -07:00
inode.c Squashfs: sanity check symbolic link size 2024-08-13 13:56:46 +02:00
Kconfig squashfs: allows users to configure the number of decompression threads 2022-11-18 13:55:08 -08:00
lz4_wrapper.c squashfs: extend "page actor" to handle missing pages 2022-06-16 19:58:21 -07:00
lzo_wrapper.c squashfs: extend "page actor" to handle missing pages 2022-06-16 19:58:21 -07:00
Makefile squashfs: always build "file direct" version of page actor 2022-07-29 18:12:34 -07:00
namei.c Squashfs: remove deprecated strncpy by not copying the string 2024-04-25 21:07:05 -07:00
page_actor.c Squashfs: Update page_actor to not use page->index 2024-08-19 14:08:20 +02:00
page_actor.h Squashfs: Ensure all readahead pages have been used 2024-08-23 13:11:36 +02:00
squashfs_fs_i.h
squashfs_fs_sb.h squashfs: cache partial compressed blocks 2023-06-09 17:44:14 -07:00
squashfs_fs.h Squashfs: fix handling and sanity checking of xattr_ids count 2023-01-31 16:44:10 -08:00
squashfs.h squashfs: move squashfs_xattr_handlers to .rodata 2023-10-10 13:49:20 +02:00
super.c squashfs: cache partial compressed blocks 2023-06-09 17:44:14 -07:00
symlink.c squashfs: convert squashfs_symlink_read_folio to use folio APIs 2024-05-08 08:41:28 -07:00
xattr_id.c revert "squashfs: harden sanity check in squashfs_read_xattr_id_table" 2023-02-03 17:52:25 -08:00
xattr.c squashfs: move squashfs_xattr_handlers to .rodata 2023-10-10 13:49:20 +02:00
xattr.h Squashfs: fix handling and sanity checking of xattr_ids count 2023-01-31 16:44:10 -08:00
xz_wrapper.c squashfs: extend "page actor" to handle missing pages 2022-06-16 19:58:21 -07:00
zlib_wrapper.c squashfs: extend "page actor" to handle missing pages 2022-06-16 19:58:21 -07:00
zstd_wrapper.c squashfs: extend "page actor" to handle missing pages 2022-06-16 19:58:21 -07:00