This is a port of Linux commit 71755ee5350b63fb1f283de8561cdb61b47f4d1d:
| Author: Linus Torvalds <torvalds@xxxxxxxxxxxxxxxxxxxx>
| AuthorDate: Thu Aug 2 08:43:35 2018 -0700
|
| The squashfs fragment reading code doesn't actually verify that the
| fragment is inside the fragment table. The end result _is_ verified to
| be inside the image when actually reading the fragment data, but before
| that is done, we may end up taking a page fault because the fragment
| table itself might not even exist.
|
| Another report from Anatoly and his endless squashfs image fuzzing.
|
| Reported-by: Анатолий Тросиненко <anatoly.trosinenko@xxxxxxxxx>
| Acked-by:: Phillip Lougher <phillip.lougher@xxxxxxxxx>,
| Cc: Willy Tarreau <w@xxxxxx>
| Signed-off-by: Linus Torvalds <torvalds@xxxxxxxxxxxxxxxxxxxx>
Reported-by: Richard Weinberger <richard@xxxxxxxxxxxxx>
Signed-off-by: Ahmad Fatoum <a.fatoum@xxxxxxxxxxxxxx>
---
fs/squashfs/fragment.c | 13 +++++++++----
fs/squashfs/squashfs_fs_sb.h | 1 +
fs/squashfs/super.c | 5 +++--
3 files changed, 13 insertions(+), 6 deletions(-)
diff --git a/fs/squashfs/fragment.c b/fs/squashfs/fragment.c
index 343444000e02..9d60741ce5f0 100644
--- a/fs/squashfs/fragment.c
+++ b/fs/squashfs/fragment.c
@@ -44,11 +44,16 @@ int squashfs_frag_lookup(struct super_block *sb, unsigned int fragment,
u64 *fragment_block)
{
struct squashfs_sb_info *msblk = sb->s_fs_info;
- int block = SQUASHFS_FRAGMENT_INDEX(fragment);
- int offset = SQUASHFS_FRAGMENT_INDEX_OFFSET(fragment);
- u64 start_block = le64_to_cpu(msblk->fragment_index[block]);
+ int block, offset, size;
struct squashfs_fragment_entry fragment_entry;
- int size;
+ u64 start_block;
+
+ if (fragment >= msblk->fragments)
+ return -EIO;
+ block = SQUASHFS_FRAGMENT_INDEX(fragment);
+ offset = SQUASHFS_FRAGMENT_INDEX_OFFSET(fragment);
+
+ start_block = le64_to_cpu(msblk->fragment_index[block]);
size = squashfs_read_metadata(sb, &fragment_entry, &start_block,
&offset, sizeof(fragment_entry));
diff --git a/fs/squashfs/squashfs_fs_sb.h b/fs/squashfs/squashfs_fs_sb.h
index c6fc37d48f25..8ac5a1f3b6e3 100644
--- a/fs/squashfs/squashfs_fs_sb.h
+++ b/fs/squashfs/squashfs_fs_sb.h
@@ -75,6 +75,7 @@ struct squashfs_sb_info {
unsigned short block_log;
long long bytes_used;
unsigned int inodes;
+ unsigned int fragments;
int xattr_ids;
struct cdev *cdev;
struct device *dev;
diff --git a/fs/squashfs/super.c b/fs/squashfs/super.c
index 2e34c0e540df..f3dac6de1527 100644
--- a/fs/squashfs/super.c
+++ b/fs/squashfs/super.c
@@ -189,6 +189,7 @@ static int squashfs_fill_super(struct super_block *sb, void *data, int silent)
msblk->inode_table = le64_to_cpu(sblk->inode_table_start);
msblk->directory_table = le64_to_cpu(sblk->directory_table_start);
msblk->inodes = le32_to_cpu(sblk->inodes);
+ msblk->fragments = le32_to_cpu(sblk->fragments);
flags = le16_to_cpu(sblk->flags);
TRACE("Found valid superblock on %pg\n", sb->s_bdev);
@@ -199,7 +200,7 @@ static int squashfs_fill_super(struct super_block *sb, void *data, int silent)
TRACE("Filesystem size %lld bytes\n", msblk->bytes_used);
TRACE("Block size %d\n", msblk->block_size);
TRACE("Number of inodes %d\n", msblk->inodes);
- TRACE("Number of fragments %d\n", le32_to_cpu(sblk->fragments));
+ TRACE("Number of fragments %d\n", msblk->fragments);
TRACE("Number of ids %d\n", le16_to_cpu(sblk->no_ids));
TRACE("sblk->inode_table_start %llx\n", msblk->inode_table);
TRACE("sblk->directory_table_start %llx\n", msblk->directory_table);
@@ -253,7 +254,7 @@ static int squashfs_fill_super(struct super_block *sb, void *data, int silent)
goto handle_fragments;
handle_fragments:
- fragments = le32_to_cpu(sblk->fragments);
+ fragments = msblk->fragments;
if (fragments == 0)
goto check_directory_table;
msblk->fragment_cache = squashfs_cache_init("fragment",
--
2.39.2
