mirror of
https://github.com/brain-hackers/linux-brain.git
synced 2024-06-09 23:36:23 +09:00
a814355e70
commit f37aa4c7366e23f91b81d00bafd6a7ab54e4a381 upstream. Sysbot has reported a number of "slab-out-of-bounds reads" and "use-after-free read" errors which has been identified as being caused by a corrupted index value read from the inode. This could be because the metadata block is uncompressed, or because the "compression" bit has been corrupted (turning a compressed block into an uncompressed block). This patch adds additional sanity checks to detect this, and the following corruption. 1. It checks against corruption of the ids count. This can either lead to a larger table to be read, or a smaller than expected table to be read. In the case of a too large ids count, this would often have been trapped by the existing sanity checks, but this patch introduces a more exact check, which can identify too small values. 2. It checks the contents of the index table for corruption. Link: https://lkml.kernel.org/r/20210204130249.4495-3-phillip@squashfs.org.uk Signed-off-by: Phillip Lougher <phillip@squashfs.org.uk> Reported-by: syzbot+b06d57ba83f604522af2@syzkaller.appspotmail.com Reported-by: syzbot+c021ba012da41ee9807c@syzkaller.appspotmail.com Reported-by: syzbot+5024636e8b5fd19f0f19@syzkaller.appspotmail.com Reported-by: syzbot+bcbc661df46657d0fa4f@syzkaller.appspotmail.com Cc: <stable@vger.kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
70 lines
1.5 KiB
C
70 lines
1.5 KiB
C
/* SPDX-License-Identifier: GPL-2.0-or-later */
|
|
#ifndef SQUASHFS_FS_SB
|
|
#define SQUASHFS_FS_SB
|
|
/*
|
|
* Squashfs
|
|
*
|
|
* Copyright (c) 2002, 2003, 2004, 2005, 2006, 2007, 2008
|
|
* Phillip Lougher <phillip@squashfs.org.uk>
|
|
*
|
|
* squashfs_fs_sb.h
|
|
*/
|
|
|
|
#include "squashfs_fs.h"
|
|
|
|
struct squashfs_cache {
|
|
char *name;
|
|
int entries;
|
|
int curr_blk;
|
|
int next_blk;
|
|
int num_waiters;
|
|
int unused;
|
|
int block_size;
|
|
int pages;
|
|
spinlock_t lock;
|
|
wait_queue_head_t wait_queue;
|
|
struct squashfs_cache_entry *entry;
|
|
};
|
|
|
|
struct squashfs_cache_entry {
|
|
u64 block;
|
|
int length;
|
|
int refcount;
|
|
u64 next_index;
|
|
int pending;
|
|
int error;
|
|
int num_waiters;
|
|
wait_queue_head_t wait_queue;
|
|
struct squashfs_cache *cache;
|
|
void **data;
|
|
struct squashfs_page_actor *actor;
|
|
};
|
|
|
|
struct squashfs_sb_info {
|
|
const struct squashfs_decompressor *decompressor;
|
|
int devblksize;
|
|
int devblksize_log2;
|
|
struct squashfs_cache *block_cache;
|
|
struct squashfs_cache *fragment_cache;
|
|
struct squashfs_cache *read_page;
|
|
int next_meta_index;
|
|
__le64 *id_table;
|
|
__le64 *fragment_index;
|
|
__le64 *xattr_id_table;
|
|
struct mutex meta_index_mutex;
|
|
struct meta_index *meta_index;
|
|
struct squashfs_stream *stream;
|
|
__le64 *inode_lookup_table;
|
|
u64 inode_table;
|
|
u64 directory_table;
|
|
u64 xattr_table;
|
|
unsigned int block_size;
|
|
unsigned short block_log;
|
|
long long bytes_used;
|
|
unsigned int inodes;
|
|
unsigned int fragments;
|
|
int xattr_ids;
|
|
unsigned int ids;
|
|
};
|
|
#endif
|