diff options
| author | Linus Torvalds <torvalds@linux-foundation.org> | 2018-07-29 12:44:46 -0700 |
|---|---|---|
| committer | Linus Torvalds <torvalds@linux-foundation.org> | 2018-07-29 12:44:46 -0700 |
| commit | 01cfb7937a9af2abb1136c7e89fbf3fd92952956 (patch) | |
| tree | 2b01fbc7eb315150d5a0ed71a218e4008801138b /fs/squashfs/fragment.c | |
| parent | a26fb01c2879ed7026e6cbd78bb701912d249eef (diff) | |
| download | linux-01cfb7937a9af2abb1136c7e89fbf3fd92952956.tar.bz2 | |
squashfs: be more careful about metadata corruption
Anatoly Trosinenko reports that a corrupted squashfs image can cause a
kernel oops. It turns out that squashfs can end up being confused about
negative fragment lengths.
The regular squashfs_read_data() does check for negative lengths, but
squashfs_read_metadata() did not, and the fragment size code just
blindly trusted the on-disk value. Fix both the fragment parsing and
the metadata reading code.
Reported-by: Anatoly Trosinenko <anatoly.trosinenko@gmail.com>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Cc: Phillip Lougher <phillip@squashfs.org.uk>
Cc: stable@kernel.org
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Diffstat (limited to 'fs/squashfs/fragment.c')
| -rw-r--r-- | fs/squashfs/fragment.c | 4 |
1 files changed, 1 insertions, 3 deletions
diff --git a/fs/squashfs/fragment.c b/fs/squashfs/fragment.c index 0ed6edbc5c71..86ad9a4b8c36 100644 --- a/fs/squashfs/fragment.c +++ b/fs/squashfs/fragment.c @@ -61,9 +61,7 @@ int squashfs_frag_lookup(struct super_block *sb, unsigned int fragment, return size; *fragment_block = le64_to_cpu(fragment_entry.start_block); - size = le32_to_cpu(fragment_entry.size); - - return size; + return squashfs_block_size(fragment_entry.size); } |