TWxSoftware/twx-linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
c70877c0fa032cc7efebe013d67827cdf9032dd8
twx-linux/fs
T
History
Phillip Lougher a0aefbeabc squashfs: fix divide error in calculate_skip() 
commit d6e621de1f upstream.

Sysbot has reported a "divide error" which has been identified as being
caused by a corrupted file_size value within the file inode.  This value
has been corrupted to a much larger value than expected.

Calculate_skip() is passed i_size_read(inode) >> msblk->block_log.  Due to
the file_size value corruption this overflows the int argument/variable in
that function, leading to the divide error.

This patch changes the function to use u64.  This will accommodate any
unexpectedly large values due to corruption.

The value returned from calculate_skip() is clamped to be never more than
SQUASHFS_CACHED_BLKS - 1, or 7.  So file_size corruption does not lead to
an unexpectedly large return result here.

Link: https://lkml.kernel.org/r/20210507152618.9447-1-phillip@squashfs.org.uk
Signed-off-by: Phillip Lougher <phillip@squashfs.org.uk>
Reported-by: <syzbot+e8f781243ce16ac2f962@syzkaller.appspotmail.com>
Reported-by: <syzbot+7b98870d4fec9447b951@syzkaller.appspotmail.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-05-22 10:59:45 +02:00
..
9p
9P: Cast to loff_t before multiplying
2020-11-05 11:08:53 +01:00
adfs
…
affs
fs/affs: release old buffer head on error path
2021-03-04 09:39:55 +01:00
afs
rxrpc: Fix deadlock around release of dst cached on udp tunnel
2021-02-10 09:21:06 +01:00
autofs
…
befs
…
bfs
…
btrfs
btrfs: fix race when picking most recent mod log operation for an old root
2021-05-22 10:59:19 +02:00
cachefiles
cachefiles: Handle readpage error correctly
2020-11-05 11:08:54 +01:00
ceph
ceph: fix race in concurrent __ceph_remove_cap invocations
2020-12-30 11:26:13 +01:00
cifs
cifs: Return correct error code from smb2_get_enc_key
2021-05-22 10:59:14 +02:00
coda
…
configfs
configfs: fix a use-after-free in __configfs_open_file
2021-03-17 16:43:51 +01:00
cramfs
…
crypto
fscrypt: add fscrypt_is_nokey_name()
2021-01-06 14:44:58 +01:00
debugfs
…
devpts
…
dlm
fs: dlm: fix debugfs dump
2021-05-22 10:59:39 +02:00
ecryptfs
ecryptfs: fix kernel panic with null dev_name
2021-05-22 10:59:13 +02:00
efivarfs
efivarfs: revert "fix memory leak in efivarfs_create()"
2020-12-02 08:48:12 +01:00
efs
…
exofs
…
exportfs
…
ext2
ext2: don't update mtime on COW faults
2020-09-09 19:04:28 +02:00
ext4
ext4: fix error code in ext4_commit_super
2021-05-22 10:59:21 +02:00
f2fs
f2fs: fix a redundant call to f2fs_balance_fs if an error occurs
2021-05-22 10:59:42 +02:00
fat
…
freevxfs
…
fscache
…
fuse
cuse: prevent clone
2021-05-22 10:59:41 +02:00
gfs2
gfs2: report "already frozen/thawed" errors
2021-04-16 11:49:30 +02:00
hfs
…
hfsplus
hfsplus: prevent corruption in shrinking truncate
2021-05-22 10:59:45 +02:00
hostfs
…
hpfs
…
hugetlbfs
mm: hugetlbfs: fix cannot migrate the fallocated HugeTLB page
2021-02-10 09:21:08 +01:00
isofs
isofs: release buffer head before return
2021-03-04 09:39:45 +01:00
jbd2
jbd2: abort journal if free a async write error metadata buffer
2020-09-03 11:24:24 +02:00
jffs2
jffs2: check the validity of dstlen in jffs2_zlib_compress()
2021-05-22 10:59:21 +02:00
jfs
JFS: more checks for invalid superblock
2021-03-07 12:18:54 +01:00
kernfs
…
lockd
lockd: don't use interval-based rebinding over TCP
2020-12-30 11:25:59 +01:00
minix
fs/minix: remove expected error message in block_to_path()
2020-08-21 11:05:38 +02:00
nfs
NFSv4.2 fix handling of sr_eof in SEEK's reply
2021-05-22 10:59:43 +02:00
nfs_common
nfs_common: need lock during iterate through the list
2020-12-30 11:26:02 +01:00
nfsd
nfsd4: readdirplus shouldn't return parent of export
2021-01-23 15:49:55 +01:00
nilfs2
…
nls
…
notify
…
ntfs
ntfs: check for valid standard information attribute
2021-03-04 09:39:29 +01:00
ocfs2
ocfs2: fix deadlock between setattr and dio_end_io_write
2021-04-14 08:22:32 +02:00
omfs
…
openpromfs
…
orangefs
…
overlayfs
ovl: fix missing revert_creds() on error path
2021-05-22 10:59:26 +02:00
proc
proc: fix lookup in /proc/net subdirectories after setns(2)
2021-01-12 20:10:17 +01:00
pstore
pstore: Fix typo in compression option name
2021-03-04 09:39:54 +01:00
qnx4
…
qnx6
…
quota
quota: Fix memory leak when handling corrupted quota file
2021-03-04 09:39:42 +01:00
ramfs
ramfs: fix nommu mmap with gaps in the page cache
2020-10-30 10:38:21 +01:00
reiserfs
reiserfs: update reiserfs_xattrs_initialized() condition
2021-04-07 12:48:50 +02:00
romfs
romfs: fix uninitialized memory leak in romfs_dev_read()
2020-08-26 10:30:59 +02:00
squashfs
squashfs: fix divide error in calculate_skip()
2021-05-22 10:59:45 +02:00
sysfs
sysfs: Add sysfs_emit and sysfs_emit_at to format sysfs output
2021-03-07 12:19:01 +01:00
sysv
…
tracefs
…
ubifs
ubifs: Only check replay with inode type to judge if inode linked
2021-05-22 10:59:19 +02:00
udf
udf: fix silent AED tagLocation corruption
2021-03-17 16:43:45 +01:00
ufs
fs/ufs: avoid potential u32 multiplication overflow
2020-08-21 11:05:38 +02:00
xfs
xfs: Fix assert failure in xfs_setattr_size()
2021-03-07 12:18:55 +01:00
aio.c
…
anon_inodes.c
…
attr.c
…
bad_inode.c
…
binfmt_aout.c
…
binfmt_elf_fdpic.c
…
binfmt_elf.c
…
binfmt_em86.c
…
binfmt_flat.c
…
binfmt_misc.c
binfmt_misc: fix possible deadlock in bm_register_write
2021-03-17 16:43:51 +01:00
binfmt_script.c
…
block_dev.c
bdev: Reduce time holding bd_mutex in sync in blkdev_close()
2020-10-01 13:14:42 +02:00
buffer.c
fs: Don't invalidate page buffers in block_write_full_page()
2020-11-05 11:08:46 +01:00
char_dev.c
…
compat_binfmt_elf.c
…
compat_ioctl.c
…
compat.c
…
coredump.c
…
d_path.c
…
dax.c
…
dcache.c
fs, fscrypt: clear DCACHE_ENCRYPTED_NAME when unaliasing directory
2020-11-05 11:08:35 +01:00
dcookies.c
…
direct-io.c
fs: direct-io: fix missing sdio->boundary
2021-04-14 08:22:32 +02:00
drop_caches.c
…
eventfd.c
…
eventpoll.c
ep_create_wakeup_source(): dentry name can change under you...
2020-10-07 08:00:09 +02:00
exec.c
exit/exec: Seperate mm_release()
2021-01-30 13:32:11 +01:00
fcntl.c
fcntl: Fix potential deadlock in send_sig{io, urg}()
2021-01-06 14:45:00 +01:00
fhandle.c
…
file_table.c
…
file.c
…
filesystems.c
…
fs_pin.c
…
fs_struct.c
…
fs-writeback.c
memcg: fix a crash in wb_workfn when a device disappears
2021-02-13 13:51:15 +01:00
inode.c
…
internal.h
…
ioctl.c
…
iomap.c
…
Kconfig
…
Kconfig.binfmt
…
libfs.c
libfs: fix error cast of negative value in simple_attr_write()
2020-11-24 13:27:23 +01:00
locks.c
…
Makefile
…
mbcache.c
…
mount.h
…
mpage.c
…
namei.c
…
namespace.c
…
no-block.c
…
nsfs.c
…
open.c
…
pipe.c
…
pnode.c
…
pnode.h
…
posix_acl.c
…
proc_namespace.c
…
read_write.c
…
readdir.c
readdir: make sure to verify directory entry for legacy interfaces too
2021-04-28 13:16:50 +02:00
select.c
kernel, fs: Introduce and use set_restart_fn() and arch_set_restart_data()
2021-03-24 11:07:37 +01:00
seq_file.c
…
signalfd.c
fs/signalfd.c: fix inconsistent return codes for signalfd4
2020-08-26 10:31:02 +02:00
splice.c
…
stack.c
…
stat.c
…
statfs.c
…
super.c
vfs: remove lockdep bogosity in __sb_start_write
2020-11-24 13:27:20 +01:00
sync.c
…
timerfd.c
…
userfaultfd.c
…
utimes.c
…
xattr.c
…