Phillip Lougher 4f99357dad Squashfs: check return result of sb_min_blocksize ... [ Upstream commit 734aa85390 ] Syzkaller reports an "UBSAN: shift-out-of-bounds in squashfs_bio_read" bug. Syzkaller forks multiple processes which after mounting the Squashfs filesystem, issues an ioctl("/dev/loop0", LOOP_SET_BLOCK_SIZE, 0x8000). Now if this ioctl occurs at the same time another process is in the process of mounting a Squashfs filesystem on /dev/loop0, the failure occurs. When this happens the following code in squashfs_fill_super() fails. ---- msblk->devblksize = sb_min_blocksize(sb, SQUASHFS_DEVBLK_SIZE); msblk->devblksize_log2 = ffz(~msblk->devblksize); ---- sb_min_blocksize() returns 0, which means msblk->devblksize is set to 0. As a result, ffz(~msblk->devblksize) returns 64, and msblk->devblksize_log2 is set to 64. This subsequently causes the UBSAN: shift-out-of-bounds in fs/squashfs/block.c:195:36 shift exponent 64 is too large for 64-bit type 'u64' (aka 'unsigned long long') This commit adds a check for a 0 return by sb_min_blocksize(). Link: https://lkml.kernel.org/r/20250409024747.876480-1-phillip@squashfs.org.uk Fixes: 0aa6661905 ("Squashfs: super block operations") Reported-by: syzbot+65761fc25a137b9c8c6e@syzkaller.appspotmail.com Closes: https://lore.kernel.org/all/67f0dd7a.050a0220.0a13.0230.GAE@google.com/ Signed-off-by: Phillip Lougher <phillip@squashfs.org.uk> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Sasha Levin <sashal@kernel.org>		2025-06-19 15:28:23 +02:00
..
block.c	squashfs: squashfs_read_data need to check if the length is 0	2024-08-19 06:04:26 +02:00
cache.c
decompressor_multi_percpu.c
decompressor_multi.c
decompressor_single.c
decompressor.c
decompressor.h
dir.c
export.c
file_cache.c
file_direct.c	Squashfs: fix variable overflow triggered by sysbot	2024-08-19 06:04:26 +02:00
file.c	Squashfs: fix variable overflow triggered by sysbot	2024-08-19 06:04:26 +02:00
fragment.c
id.c
inode.c	Squashfs: sanity check symbolic link size	2024-09-12 11:11:39 +02:00
Kconfig
lz4_wrapper.c
lzo_wrapper.c
Makefile
namei.c
page_actor.c
page_actor.h
squashfs_fs_i.h
squashfs_fs_sb.h
squashfs_fs.h
squashfs.h
super.c	Squashfs: check return result of sb_min_blocksize	2025-06-19 15:28:23 +02:00
symlink.c
xattr_id.c
xattr.c
xattr.h
xz_wrapper.c
zlib_wrapper.c
zstd_wrapper.c