squashfs: be more careful about metadata corruption
authorLinus Torvalds <torvalds@linux-foundation.org>
Sun, 29 Jul 2018 19:44:46 +0000 (12:44 -0700)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Fri, 3 Aug 2018 05:50:43 +0000 (07:50 +0200)
commit961f9feb4332f448e5d2fa4851ba86598fc112de
tree8685eb529ea91c618b5017a569cd77b032e34054
parentaf41fd042fc10e65e93ed009c4933fd65c67ef2c
squashfs: be more careful about metadata corruption

commit 01cfb7937a9af2abb1136c7e89fbf3fd92952956 upstream.

Anatoly Trosinenko reports that a corrupted squashfs image can cause a
kernel oops.  It turns out that squashfs can end up being confused about
negative fragment lengths.

The regular squashfs_read_data() does check for negative lengths, but
squashfs_read_metadata() did not, and the fragment size code just
blindly trusted the on-disk value.  Fix both the fragment parsing and
the metadata reading code.

Reported-by: Anatoly Trosinenko <anatoly.trosinenko@gmail.com>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Cc: Phillip Lougher <phillip@squashfs.org.uk>
Cc: stable@kernel.org
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
fs/squashfs/cache.c
fs/squashfs/file.c
fs/squashfs/fragment.c
fs/squashfs/squashfs_fs.h