506220d2ba
Sysbot has reported a warning where a kmalloc() attempt exceeds the maximum limit. This has been identified as corruption of the xattr_ids count when reading the xattr id lookup table. This patch adds a number of additional sanity checks to detect this corruption and others. 1. It checks for a corrupted xattr index read from the inode. This could be because the metadata block is uncompressed, or because the "compression" bit has been corrupted (turning a compressed block into an uncompressed block). This would cause an out of bounds read. 2. It checks against corruption of the xattr_ids count. This can either lead to the above kmalloc failure, or a smaller than expected table to be read. 3. It checks the contents of the index table for corruption. [phillip@squashfs.org.uk: fix checkpatch issue] Link: https://lkml.kernel.org/r/270245655.754655.1612770082682@webmail.123-reg.co.uk Link: https://lkml.kernel.org/r/20210204130249.4495-5-phillip@squashfs.org.uk Signed-off-by: Phillip Lougher <phillip@squashfs.org.uk> Reported-by: syzbot+2ccea6339d368360800d@syzkaller.appspotmail.com Cc: <stable@vger.kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> |
||
---|---|---|
.. | ||
block.c | ||
cache.c | ||
decompressor_multi_percpu.c | ||
decompressor_multi.c | ||
decompressor_single.c | ||
decompressor.c | ||
decompressor.h | ||
dir.c | ||
export.c | ||
file_cache.c | ||
file_direct.c | ||
file.c | ||
fragment.c | ||
id.c | ||
inode.c | ||
Kconfig | ||
lz4_wrapper.c | ||
lzo_wrapper.c | ||
Makefile | ||
namei.c | ||
page_actor.c | ||
page_actor.h | ||
squashfs_fs_i.h | ||
squashfs_fs_sb.h | ||
squashfs_fs.h | ||
squashfs.h | ||
super.c | ||
symlink.c | ||
xattr_id.c | ||
xattr.c | ||
xattr.h | ||
xz_wrapper.c | ||
zlib_wrapper.c | ||
zstd_wrapper.c |