All of lore.kernel.org
 help / color / mirror / Atom feed
* [PATCH] Squashfs: fix xattr id and id lookup sanity checks
@ 2021-03-01  7:27 Phillip Lougher
  2021-03-03  0:34 ` Andrew Morton
  2021-03-09  5:37 ` Andrew Morton
  0 siblings, 2 replies; 5+ messages in thread
From: Phillip Lougher @ 2021-03-01  7:27 UTC (permalink / raw)
  To: linux-kernel, Andrew Morton

The checks for maximum metadata block size is
missing SQUASHFS_BLOCK_OFFSET (the two byte length
count).

Cc: stable@vger.kernel.org
Signed-off-by: Phillip Lougher <phillip@squashfs.org.uk>
---
 fs/squashfs/id.c       | 6 ++++--
 fs/squashfs/xattr_id.c | 6 ++++--
 2 files changed, 8 insertions(+), 4 deletions(-)

diff --git a/fs/squashfs/id.c b/fs/squashfs/id.c
index 11581bf31af4..ea5387679723 100644
--- a/fs/squashfs/id.c
+++ b/fs/squashfs/id.c
@@ -97,14 +97,16 @@ __le64 *squashfs_read_id_index_table(struct super_block *sb,
 		start = le64_to_cpu(table[n]);
 		end = le64_to_cpu(table[n + 1]);
 
-		if (start >= end || (end - start) > SQUASHFS_METADATA_SIZE) {
+		if (start >= end || (end - start) >
+				(SQUASHFS_METADATA_SIZE + SQUASHFS_BLOCK_OFFSET)) {
 			kfree(table);
 			return ERR_PTR(-EINVAL);
 		}
 	}
 
 	start = le64_to_cpu(table[indexes - 1]);
-	if (start >= id_table_start || (id_table_start - start) > SQUASHFS_METADATA_SIZE) {
+	if (start >= id_table_start || (id_table_start - start) >
+				(SQUASHFS_METADATA_SIZE + SQUASHFS_BLOCK_OFFSET)) {
 		kfree(table);
 		return ERR_PTR(-EINVAL);
 	}
diff --git a/fs/squashfs/xattr_id.c b/fs/squashfs/xattr_id.c
index ead66670b41a..087cab8c78f4 100644
--- a/fs/squashfs/xattr_id.c
+++ b/fs/squashfs/xattr_id.c
@@ -109,14 +109,16 @@ __le64 *squashfs_read_xattr_id_table(struct super_block *sb, u64 table_start,
 		start = le64_to_cpu(table[n]);
 		end = le64_to_cpu(table[n + 1]);
 
-		if (start >= end || (end - start) > SQUASHFS_METADATA_SIZE) {
+		if (start >= end || (end - start) >
+				(SQUASHFS_METADATA_SIZE + SQUASHFS_BLOCK_OFFSET)) {
 			kfree(table);
 			return ERR_PTR(-EINVAL);
 		}
 	}
 
 	start = le64_to_cpu(table[indexes - 1]);
-	if (start >= table_start || (table_start - start) > SQUASHFS_METADATA_SIZE) {
+	if (start >= table_start || (table_start - start) >
+				(SQUASHFS_METADATA_SIZE + SQUASHFS_BLOCK_OFFSET)) {
 		kfree(table);
 		return ERR_PTR(-EINVAL);
 	}
-- 
2.29.2

^ permalink raw reply related	[flat|nested] 5+ messages in thread
* Re: [PATCH] Squashfs: fix xattr id and id lookup sanity checks
  2021-03-01  7:27 [PATCH] Squashfs: fix xattr id and id lookup sanity checks Phillip Lougher
@ 2021-03-03  0:34 ` Andrew Morton
  2021-03-03  0:58   ` Phillip Lougher
  2021-03-09  5:37 ` Andrew Morton
  1 sibling, 1 reply; 5+ messages in thread
From: Andrew Morton @ 2021-03-03  0:34 UTC (permalink / raw)
  To: Phillip Lougher; +Cc: linux-kernel

On Mon, 1 Mar 2021 07:27:57 +0000 (GMT) Phillip Lougher <phillip@squashfs.org.uk> wrote:

> The checks for maximum metadata block size is
> missing SQUASHFS_BLOCK_OFFSET (the two byte length
> count).

What are the user visible consequences of this bug?

> Cc: stable@vger.kernel.org
> Signed-off-by: Phillip Lougher <phillip@squashfs.org.uk>

Fixes: f37aa4c7366e23f ("squashfs: add more sanity checks in id lookup")

yes?



^ permalink raw reply	[flat|nested] 5+ messages in thread
* Re: [PATCH] Squashfs: fix xattr id and id lookup sanity checks
  2021-03-03  0:34 ` Andrew Morton
@ 2021-03-03  0:58   ` Phillip Lougher
  0 siblings, 0 replies; 5+ messages in thread
From: Phillip Lougher @ 2021-03-03  0:58 UTC (permalink / raw)
  To: Andrew Morton; +Cc: linux-kernel


> On 03/03/2021 00:34 Andrew Morton <akpm@linux-foundation.org> wrote:
> 
>  
> On Mon, 1 Mar 2021 07:27:57 +0000 (GMT) Phillip Lougher <phillip@squashfs.org.uk> wrote:
> 
> > The checks for maximum metadata block size is
> > missing SQUASHFS_BLOCK_OFFSET (the two byte length
> > count).
> 
> What are the user visible consequences of this bug?

The user will be unable to mount the filesystem, because it will
fail the sanity check.


> 
> > Cc: stable@vger.kernel.org
> > Signed-off-by: Phillip Lougher <phillip@squashfs.org.uk>
> 
> Fixes: f37aa4c7366e23f ("squashfs: add more sanity checks in id lookup")
> 
> yes?

Yes.

Phillip

^ permalink raw reply	[flat|nested] 5+ messages in thread
* Re: [PATCH] Squashfs: fix xattr id and id lookup sanity checks
  2021-03-01  7:27 [PATCH] Squashfs: fix xattr id and id lookup sanity checks Phillip Lougher
  2021-03-03  0:34 ` Andrew Morton
@ 2021-03-09  5:37 ` Andrew Morton
  1 sibling, 0 replies; 5+ messages in thread
From: Andrew Morton @ 2021-03-09  5:37 UTC (permalink / raw)
  To: Phillip Lougher; +Cc: linux-kernel

On Mon, 1 Mar 2021 07:27:57 +0000 (GMT) Phillip Lougher <phillip@squashfs.org.uk> wrote:

> The checks for maximum metadata block size is
> missing SQUASHFS_BLOCK_OFFSET (the two byte length
> count).

There is no definition of SQUASHFS_BLOCK_OFFSET.  Makes compiler unhappy.

^ permalink raw reply	[flat|nested] 5+ messages in thread
* Re: [PATCH] Squashfs: fix xattr id and id lookup sanity checks
@ 2021-03-09 14:43 Sean Nyekjaer
  0 siblings, 0 replies; 5+ messages in thread
From: Sean Nyekjaer @ 2021-03-09 14:43 UTC (permalink / raw)
  To: Andrew Morton; +Cc: Phillip Lougher, linux-kernel

Hi Andrew

This patch depends on my patch ([PATCH] squashfs: fix inode lookup sanity checks)
which add's the SQUASHFS_BLOCK_OFFSET :)

/Sean


^ permalink raw reply	[flat|nested] 5+ messages in thread
end of thread, other threads:[~2021-03-09 14:44 UTC | newest]

Thread overview: 5+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-03-01  7:27 [PATCH] Squashfs: fix xattr id and id lookup sanity checks Phillip Lougher
2021-03-03  0:34 ` Andrew Morton
2021-03-03  0:58   ` Phillip Lougher
2021-03-09  5:37 ` Andrew Morton
2021-03-09 14:43 Sean Nyekjaer

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.