Phillip Lougher fdb24a820a Squashfs: check metadata block offset is within range ...

Syzkaller reports a "general protection fault in squashfs_copy_data"

This is ultimately caused by a corrupted index look-up table, which
produces a negative metadata block offset.

This is subsequently passed to squashfs_copy_data (via
squashfs_read_metadata) where the negative offset causes an out of bounds
access.

The fix is to check that the offset is within range in
squashfs_read_metadata.  This will trap this and other cases.

Link: https://lkml.kernel.org/r/20260217050955.138351-1-phillip@squashfs.org.uk
Fixes: f400e12656 ("Squashfs: cache operations")
Reported-by: syzbot+a9747fe1c35a5b115d3f@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/all/699234e2.a70a0220.2c38d7.00e2.GAE@google.com/
Signed-off-by: Phillip Lougher <phillip@squashfs.org.uk>
Cc: Christian Brauner <brauner@kernel.org>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>

2026-02-24 11:13:27 -08:00

..

block.c

treewide: Replace kmalloc with kmalloc_obj for non-scalar types

2026-02-21 01:02:28 -08:00

cache.c

Squashfs: check metadata block offset is within range

2026-02-24 11:13:27 -08:00

decompressor_multi_percpu.c

squashfs: fix percpu address space issues in decompressor_multi_percpu.c

2024-09-09 16:47:41 -07:00

decompressor_multi.c

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

decompressor_single.c

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

decompressor.c

squashfs: don't include buffer_head.h

2023-06-09 17:44:14 -07:00

decompressor.h

squashfs: extend "page actor" to handle missing pages

2022-06-16 19:58:21 -07:00

dir.c

squashfs: add setlease file operation

2026-01-12 10:55:47 +01:00

export.c

exportfs: make ->encode_fh() a mandatory method for NFS export

2023-10-28 16:15:15 +02:00

file_cache.c

squashfs; convert squashfs_copy_cache() to take a folio

2025-01-24 22:47:22 -08:00

file_direct.c

squashfs: convert squashfs_readpage_block() to take a folio

2025-01-24 22:47:22 -08:00

file.c

Convert remaining multi-line kmalloc_obj/flex GFP_KERNEL uses

2026-02-22 08:26:33 -08:00

fragment.c

…

id.c

…

inode.c

Coccinelle-based conversion to use ->i_state accessors

2025-10-20 20:22:26 +02:00

Kconfig

squashfs: add optional full compressed block caching

2025-05-27 19:40:33 -07:00

lz4_wrapper.c

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

lzo_wrapper.c

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

Makefile

squashfs: always build "file direct" version of page actor

2022-07-29 18:12:34 -07:00

namei.c

Squashfs: remove deprecated strncpy by not copying the string

2024-04-25 21:07:05 -07:00

page_actor.c

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

page_actor.h

Squashfs: Ensure all readahead pages have been used

2024-08-23 13:11:36 +02:00

squashfs_fs_i.h

Squashfs: fix uninit-value in squashfs_get_parent

2025-09-28 11:36:12 -07:00

squashfs_fs_sb.h

squashfs: cache partial compressed blocks

2023-06-09 17:44:14 -07:00

squashfs_fs.h

Squashfs: add SEEK_DATA/SEEK_HOLE support

2025-09-28 11:36:14 -07:00

squashfs.h

Squashfs: add SEEK_DATA/SEEK_HOLE support

2025-09-28 11:36:14 -07:00

super.c

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

symlink.c

squashfs: convert squashfs_symlink_read_folio to use folio APIs

2024-05-08 08:41:28 -07:00

xattr_id.c

revert "squashfs: harden sanity check in squashfs_read_xattr_id_table"

2023-02-03 17:52:25 -08:00

xattr.c

squashfs: move squashfs_xattr_handlers to .rodata

2023-10-10 13:49:20 +02:00

xattr.h

Squashfs: fix handling and sanity checking of xattr_ids count

2023-01-31 16:44:10 -08:00

xz_wrapper.c

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

zlib_wrapper.c

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

zstd_wrapper.c

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00