The quilt patch titled
Subject: squashfs: fix invalid pointer dereference in squashfs_cache_delete
has been removed from the -mm tree. Its filename was
squashfs-fix-invalid-pointer-dereference-in-squashfs_cache_delete.patch
This patch was dropped because it was merged into the mm-hotfixes-stable branch
of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
------------------------------------------------------
From: Zhiyu Zhang <zhiyuzhang999@xxxxxxxxx>
Subject: squashfs: fix invalid pointer dereference in squashfs_cache_delete
Date: Thu, 6 Mar 2025 21:28:55 +0800
When mounting a squashfs fails, squashfs_cache_init() may return an error
pointer (e.g., -ENOMEM) instead of NULL. However, squashfs_cache_delete()
only checks for a NULL cache, and attempts to dereference the invalid
pointer. This leads to a kernel crash (BUG: unable to handle kernel
paging request in squashfs_cache_delete).
This patch fixes the issue by checking IS_ERR(cache) before accessing it.
Link: https://lkml.kernel.org/r/20250306132855.2030-1-zhiyuzhang999@xxxxxxxxx
Fixes: 49ff29240ebb ("squashfs: make squashfs_cache_init() return ERR_PTR(-ENOMEM)")
Signed-off-by: Zhiyu Zhang <zhiyuzhang999@xxxxxxxxx>
Reported-by: Zhiyu Zhang <zhiyuzhang999@xxxxxxxxx>
Closes: https://lore.kernel.org/linux-fsdevel/CALf2hKvaq8B4u5yfrE+BYt7aNguao99mfWxHngA+=o5hwzjdOg@xxxxxxxxxxxxxx/
Tested-by: Zhiyu Zhang <zhiyuzhang999@xxxxxxxxx>
Reviewed-by: Phillip Lougher <phillip@xxxxxxxxxxxxxxx>
Signed-off-by: Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx>
---
fs/squashfs/cache.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/fs/squashfs/cache.c~squashfs-fix-invalid-pointer-dereference-in-squashfs_cache_delete
+++ a/fs/squashfs/cache.c
@@ -198,7 +198,7 @@ void squashfs_cache_delete(struct squash
{
int i, j;
- if (cache == NULL)
+ if (IS_ERR(cache) || cache == NULL)
return;
for (i = 0; i < cache->entries; i++) {
_
Patches currently in -mm which might be from zhiyuzhang999@xxxxxxxxx are
