This is a port of Linux commit a3f94cb99a854fa381fe7fadd97c4f61633717a5:
| Author: Phillip Lougher <phillip@xxxxxxxxxxxxxxx>
| AuthorDate: Thu Aug 2 16:45:15 2018 +0100
|
| Previously in squashfs_readpage() when copying data into the page
| cache, it used the length of the datablock read from the filesystem
| (after decompression). However, if the filesystem has been corrupted
| this data block may be short, which will leave pages unfilled.
|
| The fix for this is to compute the expected number of bytes to copy
| from the inode size, and use this to detect if the block is short.
|
| Signed-off-by: Phillip Lougher <phillip@xxxxxxxxxxxxxxx>
| Tested-by: Willy Tarreau <w@xxxxxx>
| Cc: Анатолий Тросиненко <anatoly.trosinenko@xxxxxxxxx>
| Signed-off-by: Linus Torvalds <torvalds@xxxxxxxxxxxxxxxxxxxx>
Reported-by: Richard Weinberger <richard@xxxxxxxxxxxxx>
Signed-off-by: Ahmad Fatoum <a.fatoum@xxxxxxxxxxxxxx>
---
fs/squashfs/file.c | 26 ++++++++++----------------
fs/squashfs/file_cache.c | 4 ++--
fs/squashfs/squashfs.h | 2 +-
3 files changed, 13 insertions(+), 19 deletions(-)
diff --git a/fs/squashfs/file.c b/fs/squashfs/file.c
index 8316f0edb645..16914415299a 100644
--- a/fs/squashfs/file.c
+++ b/fs/squashfs/file.c
@@ -388,10 +388,9 @@ int squashfs_copy_cache(struct page *page, struct squashfs_cache_entry *buffer,
}
/* Read datablock stored packed inside a fragment (tail-end packed block) */
-static int squashfs_readpage_fragment(struct page *page)
+static int squashfs_readpage_fragment(struct page *page, int expected)
{
struct inode *inode = page->inode;
- struct squashfs_sb_info *msblk = inode->i_sb->s_fs_info;
struct squashfs_cache_entry *buffer = squashfs_get_fragment(inode->i_sb,
squashfs_i(inode)->fragment_block,
squashfs_i(inode)->fragment_size);
@@ -404,24 +403,16 @@ static int squashfs_readpage_fragment(struct page *page)
squashfs_i(inode)->fragment_block,
squashfs_i(inode)->fragment_size);
else
- squashfs_copy_cache(page, buffer, i_size_read(inode) &
- (msblk->block_size - 1),
+ squashfs_copy_cache(page, buffer, expected,
squashfs_i(inode)->fragment_offset);
squashfs_cache_put(buffer);
return res;
}
-static int squashfs_readpage_sparse(struct page *page, int index, int file_end)
+static int squashfs_readpage_sparse(struct page *page, int expected)
{
- struct inode *inode = page->inode;
- struct squashfs_sb_info *msblk = inode->i_sb->s_fs_info;
- int bytes = index == file_end ?
- (i_size_read(inode) & (msblk->block_size - 1)) :
- msblk->block_size;
-
- squashfs_copy_cache(page, NULL, bytes, 0);
-
+ squashfs_copy_cache(page, NULL, expected, 0);
return 0;
}
@@ -431,6 +422,9 @@ int squashfs_readpage(struct file *file, struct page *page)
struct squashfs_sb_info *msblk = inode->i_sb->s_fs_info;
int index = page->index >> (msblk->block_log - PAGE_CACHE_SHIFT);
int file_end = i_size_read(inode) >> msblk->block_log;
+ int expected = index == file_end ?
+ (i_size_read(inode) & (msblk->block_size - 1)) :
+ msblk->block_size;
int res;
TRACE("Entered squashfs_readpage, page index %lx, start block %llx\n",
@@ -448,11 +442,11 @@ int squashfs_readpage(struct file *file, struct page *page)
goto out;
if (bsize == 0)
- res = squashfs_readpage_sparse(page, index, file_end);
+ res = squashfs_readpage_sparse(page, expected);
else
- res = squashfs_readpage_block(page, block, bsize);
+ res = squashfs_readpage_block(page, block, bsize, expected);
} else
- res = squashfs_readpage_fragment(page);
+ res = squashfs_readpage_fragment(page, expected);
if (!res)
return 0;
diff --git a/fs/squashfs/file_cache.c b/fs/squashfs/file_cache.c
index fbd829849d18..0b64be0994c7 100644
--- a/fs/squashfs/file_cache.c
+++ b/fs/squashfs/file_cache.c
@@ -17,7 +17,7 @@
#include "squashfs.h"
/* Read separately compressed datablock and memcopy into page cache */
-int squashfs_readpage_block(struct page *page, u64 block, int bsize)
+int squashfs_readpage_block(struct page *page, u64 block, int bsize, int expected)
{
struct inode *i = page->inode;
struct squashfs_cache_entry *buffer = squashfs_get_datablock(i->i_sb,
@@ -25,7 +25,7 @@ int squashfs_readpage_block(struct page *page, u64 block, int bsize)
int res = buffer->error;
if (!res)
- res = squashfs_copy_cache(page, buffer, buffer->length, 0);
+ res = squashfs_copy_cache(page, buffer, expected, 0);
if (res)
ERROR("Unable to read page, block %llx, size %x\n", block,
diff --git a/fs/squashfs/squashfs.h b/fs/squashfs/squashfs.h
index 456021dcfd3e..1f2fee59d688 100644
--- a/fs/squashfs/squashfs.h
+++ b/fs/squashfs/squashfs.h
@@ -98,7 +98,7 @@ int squashfs_copy_cache(struct page *, struct squashfs_cache_entry *, int,
extern int squashfs_readpage(struct file *file, struct page *page);
/* file_xxx.c */
-extern int squashfs_readpage_block(struct page *, u64, int);
+extern int squashfs_readpage_block(struct page *, u64, int, int);
/* id.c */
extern int squashfs_get_id(struct super_block *, unsigned int, unsigned int *);
--
2.39.2
