mirror of https://github.com/torvalds/linux.git
fdb24a820a
Syzkaller reports a "general protection fault in squashfs_copy_data"
This is ultimately caused by a corrupted index look-up table, which
produces a negative metadata block offset.
This is subsequently passed to squashfs_copy_data (via
squashfs_read_metadata) where the negative offset causes an out of bounds
access.
The fix is to check that the offset is within range in
squashfs_read_metadata. This will trap this and other cases.
Link: https://lkml.kernel.org/r/20260217050955.138351-1-phillip@squashfs.org.uk
Fixes:
|
||
|---|---|---|
| .. | ||
| Kconfig | ||
| Makefile | ||
| block.c | ||
| cache.c | ||
| decompressor.c | ||
| decompressor.h | ||
| decompressor_multi.c | ||
| decompressor_multi_percpu.c | ||
| decompressor_single.c | ||
| dir.c | ||
| export.c | ||
| file.c | ||
| file_cache.c | ||
| file_direct.c | ||
| fragment.c | ||
| id.c | ||
| inode.c | ||
| lz4_wrapper.c | ||
| lzo_wrapper.c | ||
| namei.c | ||
| page_actor.c | ||
| page_actor.h | ||
| squashfs.h | ||
| squashfs_fs.h | ||
| squashfs_fs_i.h | ||
| squashfs_fs_sb.h | ||
| super.c | ||
| symlink.c | ||
| xattr.c | ||
| xattr.h | ||
| xattr_id.c | ||
| xz_wrapper.c | ||
| zlib_wrapper.c | ||
| zstd_wrapper.c | ||