mirror of
git://git.yoctoproject.org/linux-yocto.git
synced 2026-01-27 12:47:24 +01:00
74058c0a9f
Syzkaller reports a "KMSAN: uninit-value in squashfs_get_parent" bug.
This is caused by open_by_handle_at() being called with a file handle
containing an invalid parent inode number. In particular the inode number
is that of a symbolic link, rather than a directory.
Squashfs_get_parent() gets called with that symbolic link inode, and
accesses the parent member field.
unsigned int parent_ino = squashfs_i(inode)->parent;
Because non-directory inodes in Squashfs do not have a parent value, this
is uninitialised, and this causes an uninitialised value access.
The fix is to initialise parent with the invalid inode 0, which will cause
an EINVAL error to be returned.
Regular inodes used to share the parent field with the block_list_start
field. This is removed in this commit to enable the parent field to
contain the invalid inode number 0.
Link: https://lkml.kernel.org/r/20250918233308.293861-1-phillip@squashfs.org.uk
Fixes: 122601408d ("Squashfs: export operations")
Signed-off-by: Phillip Lougher <phillip@squashfs.org.uk>
Reported-by: syzbot+157bdef5cf596ad0da2c@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/all/68cc2431.050a0220.139b6.0001.GAE@google.com/
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
42 lines
762 B
C
42 lines
762 B
C
/* SPDX-License-Identifier: GPL-2.0-or-later */
|
|
#ifndef SQUASHFS_FS_I
|
|
#define SQUASHFS_FS_I
|
|
/*
|
|
* Squashfs
|
|
*
|
|
* Copyright (c) 2002, 2003, 2004, 2005, 2006, 2007, 2008
|
|
* Phillip Lougher <phillip@squashfs.org.uk>
|
|
*
|
|
* squashfs_fs_i.h
|
|
*/
|
|
|
|
struct squashfs_inode_info {
|
|
u64 start;
|
|
int offset;
|
|
u64 xattr;
|
|
unsigned int xattr_size;
|
|
int xattr_count;
|
|
int parent;
|
|
union {
|
|
struct {
|
|
u64 fragment_block;
|
|
int fragment_size;
|
|
int fragment_offset;
|
|
u64 block_list_start;
|
|
};
|
|
struct {
|
|
u64 dir_idx_start;
|
|
int dir_idx_offset;
|
|
int dir_idx_cnt;
|
|
};
|
|
};
|
|
struct inode vfs_inode;
|
|
};
|
|
|
|
|
|
static inline struct squashfs_inode_info *squashfs_i(struct inode *inode)
|
|
{
|
|
return container_of(inode, struct squashfs_inode_info, vfs_inode);
|
|
}
|
|
#endif
|