squashfs: more metadata hardening
authorLinus Torvalds <torvalds@linux-foundation.org>
Mon, 30 Jul 2018 21:27:15 +0000 (14:27 -0700)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Mon, 6 Aug 2018 14:20:48 +0000 (16:20 +0200)
commit953f918d548b569d37467fadb7266d0cd93a9ff6
tree2f302c7cded42a3d453a67b54a0eacbf915bcfea
parenta766ccbf1d29db4f3a793131c2e986287757107c
squashfs: more metadata hardening

commit d512584780d3e6a7cacb2f482834849453d444a1 upstream.

Anatoly reports another squashfs fuzzing issue, where the decompression
parameters themselves are in a compressed block.

This causes squashfs_read_data() to be called in order to read the
decompression options before the decompression stream having been set
up, making squashfs go sideways.

Reported-by: Anatoly Trosinenko <anatoly.trosinenko@gmail.com>
Acked-by: Phillip Lougher <phillip.lougher@gmail.com>
Cc: stable@kernel.org
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
fs/squashfs/block.c