• Phillip Lougher's avatar
    squashfs: add more sanity checks in id lookup · f37aa4c7
    Phillip Lougher authored
    Sysbot has reported a number of "slab-out-of-bounds reads" and
    "use-after-free read" errors which has been identified as being caused
    by a corrupted index value read from the inode.  This could be because
    the metadata block is uncompressed, or because the "compression" bit has
    been corrupted (turning a compressed block into an uncompressed block).
    
    This patch adds additional sanity checks to detect this, and the
    following corruption.
    
    1. It checks against corruption of the ids count.  This can either
       lead to a larger table to be read, or a smaller than expected
       table to be read.
    
       In the case of a too large ids count, this would often have been
       trapped by the existing sanity checks, but this patch introduces
       a more exact check, which can identify too small values.
    
    2. It checks the contents of the index table for corruption.
    
    Link: https://lkml.kernel.org/r/20210204130249.4495-3-phillip@squashfs.org.ukSigned-off-by: default avatarPhillip Lougher <phillip@squashfs.org.uk>
    Reported-by: syzbot+b06d57ba83f604522af2@syzkaller.appspotmail.com
    Reported-by: syzbot+c021ba012da41ee9807c@syzkaller.appspotmail.com
    Reported-by: syzbot+5024636e8b5fd19f0f19@syzkaller.appspotmail.com
    Reported-by: syzbot+bcbc661df46657d0fa4f@syzkaller.appspotmail.com
    Cc: <stable@vger.kernel.org>
    Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
    Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
    f37aa4c7
xattr.h 1.11 KB