Phillip Lougher bddcce15cd squashfs: add more sanity checks in xattr id lookup
commit 506220d2ba21791314af569211ffd8870b8208fa upstream.

Sysbot has reported a warning where a kmalloc() attempt exceeds the
maximum limit.  This has been identified as corruption of the xattr_ids
count when reading the xattr id lookup table.

This patch adds a number of additional sanity checks to detect this
corruption and others.

1. It checks for a corrupted xattr index read from the inode.  This could
   be because the metadata block is uncompressed, or because the
   "compression" bit has been corrupted (turning a compressed block
   into an uncompressed block).  This would cause an out of bounds read.

2. It checks against corruption of the xattr_ids count.  This can either
   lead to the above kmalloc failure, or a smaller than expected
   table to be read.

3. It checks the contents of the index table for corruption.

[phillip@squashfs.org.uk: fix checkpatch issue]
  Link: https://lkml.kernel.org/r/270245655.754655.1612770082682@webmail.123-reg.co.uk

Link: https://lkml.kernel.org/r/20210204130249.4495-5-phillip@squashfs.org.uk
Signed-off-by: Phillip Lougher <phillip@squashfs.org.uk>
Reported-by: syzbot+2ccea6339d368360800d@syzkaller.appspotmail.com
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-02-13 13:55:19 +01:00
..
2020-10-16 11:11:22 -07:00
2021-01-09 13:46:24 +01:00
2020-11-19 22:38:29 -05:00
2020-11-14 11:26:04 -08:00
2020-09-10 14:03:31 -07:00
2021-01-17 14:17:03 +01:00
2020-10-19 14:28:30 -07:00
\n
2020-10-15 15:03:10 -07:00
2020-08-04 21:02:38 -04:00
2020-09-22 23:45:57 -04:00
2020-07-31 08:16:01 +02:00
2020-08-07 11:33:24 -07:00
2020-10-23 11:33:41 -07:00
2021-01-27 11:55:29 +01:00
2020-10-23 11:33:41 -07:00
2020-07-31 08:16:00 +02:00
2020-10-24 12:40:18 -07:00
2020-09-26 22:55:05 -04:00
2020-08-27 16:06:47 -04:00
2020-07-31 08:16:01 +02:00