linux/fs/squashfs
Phillip Lougher 9253c54e01 Squashfs: check the inode number is not the invalid value of zero
Syskiller has produced an out of bounds access in fill_meta_index().

That out of bounds access is ultimately caused because the inode
has an inode number with the invalid value of zero, which was not checked.

The reason this causes the out of bounds access is due to following
sequence of events:

1. Fill_meta_index() is called to allocate (via empty_meta_index())
   and fill a metadata index.  It however suffers a data read error
   and aborts, invalidating the newly returned empty metadata index.
   It does this by setting the inode number of the index to zero,
   which means unused (zero is not a valid inode number).

2. When fill_meta_index() is subsequently called again on another
   read operation, locate_meta_index() returns the previous index
   because it matches the inode number of 0.  Because this index
   has been returned it is expected to have been filled, and because
   it hasn't been, an out of bounds access is performed.

This patch adds a sanity check which checks that the inode number
is not zero when the inode is created and returns -EINVAL if it is.

[phillip@squashfs.org.uk: whitespace fix]
  Link: https://lkml.kernel.org/r/20240409204723.446925-1-phillip@squashfs.org.uk
Link: https://lkml.kernel.org/r/20240408220206.435788-1-phillip@squashfs.org.uk
Signed-off-by: Phillip Lougher <phillip@squashfs.org.uk>
Reported-by: "Ubisectech Sirius" <bugreport@ubisectech.com>
Closes: https://lore.kernel.org/lkml/87f5c007-b8a5-41ae-8b57-431e924c5915.bugreport@ubisectech.com/
Cc: Christian Brauner <brauner@kernel.org>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2024-04-16 15:39:50 -07:00
..
block.c squashfs: squashfs_read_data need to check if the length is 0 2023-12-06 16:12:45 -08:00
cache.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 35 2019-05-24 17:27:11 +02:00
decompressor_multi_percpu.c squashfs: don't include buffer_head.h 2023-06-09 17:44:14 -07:00
decompressor_multi.c squashfs: allows users to configure the number of decompression threads 2022-11-18 13:55:08 -08:00
decompressor_single.c squashfs: add the mount parameter theads=<single|multi|percpu> 2022-11-18 13:55:08 -08:00
decompressor.c squashfs: don't include buffer_head.h 2023-06-09 17:44:14 -07:00
decompressor.h squashfs: extend "page actor" to handle missing pages 2022-06-16 19:58:21 -07:00
dir.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 35 2019-05-24 17:27:11 +02:00
export.c exportfs: make ->encode_fh() a mandatory method for NFS export 2023-10-28 16:15:15 +02:00
file_cache.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 499 2019-06-19 17:09:53 +02:00
file_direct.c Squashfs: fix variable overflow triggered by sysbot 2023-12-10 17:21:26 -08:00
file.c Squashfs: fix variable overflow triggered by sysbot 2023-12-10 17:21:26 -08:00
fragment.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 35 2019-05-24 17:27:11 +02:00
id.c squashfs: fix xattr id and id lookup sanity checks 2021-03-25 09:22:55 -07:00
inode.c Squashfs: check the inode number is not the invalid value of zero 2024-04-16 15:39:50 -07:00
Kconfig squashfs: allows users to configure the number of decompression threads 2022-11-18 13:55:08 -08:00
lz4_wrapper.c squashfs: extend "page actor" to handle missing pages 2022-06-16 19:58:21 -07:00
lzo_wrapper.c squashfs: extend "page actor" to handle missing pages 2022-06-16 19:58:21 -07:00
Makefile squashfs: always build "file direct" version of page actor 2022-07-29 18:12:34 -07:00
namei.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 35 2019-05-24 17:27:11 +02:00
page_actor.c squashfs: fix read regression introduced in readahead code 2022-10-28 13:37:21 -07:00
page_actor.h squashfs: fix read regression introduced in readahead code 2022-10-28 13:37:21 -07:00
squashfs_fs_i.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 35 2019-05-24 17:27:11 +02:00
squashfs_fs_sb.h squashfs: cache partial compressed blocks 2023-06-09 17:44:14 -07:00
squashfs_fs.h Squashfs: fix handling and sanity checking of xattr_ids count 2023-01-31 16:44:10 -08:00
squashfs.h squashfs: move squashfs_xattr_handlers to .rodata 2023-10-10 13:49:20 +02:00
super.c squashfs: cache partial compressed blocks 2023-06-09 17:44:14 -07:00
symlink.c squashfs: Convert squashfs to read_folio 2022-05-09 16:21:46 -04:00
xattr_id.c revert "squashfs: harden sanity check in squashfs_read_xattr_id_table" 2023-02-03 17:52:25 -08:00
xattr.c squashfs: move squashfs_xattr_handlers to .rodata 2023-10-10 13:49:20 +02:00
xattr.h Squashfs: fix handling and sanity checking of xattr_ids count 2023-01-31 16:44:10 -08:00
xz_wrapper.c squashfs: extend "page actor" to handle missing pages 2022-06-16 19:58:21 -07:00
zlib_wrapper.c squashfs: extend "page actor" to handle missing pages 2022-06-16 19:58:21 -07:00
zstd_wrapper.c squashfs: extend "page actor" to handle missing pages 2022-06-16 19:58:21 -07:00