squashfs: more metadata hardening

The squashfs fragment reading code doesn't actually verify that the
fragment is inside the fragment table.  The end result _is_ verified to
be inside the image when actually reading the fragment data, but before
that is done, we may end up taking a page fault because the fragment
table itself might not even exist.

Another report from Anatoly and his endless squashfs image fuzzing.

Reported-by: Анатолий Тросиненко <anatoly.trosinenko@gmail.com>
Acked-by:: Phillip Lougher <phillip.lougher@gmail.com>,
Cc: Willy Tarreau <w@1wt.eu>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

diff --git a/fs/squashfs/fragment.c b/fs/squashfs/fragment.c
index 86ad9a4b8c364d389df43f1fa6beb2e6b737e827..0681feab4a8499562ccad42cd53b31f05d5776f3 100644 (file)
--- a/fs/squashfs/fragment.c
+++ b/fs/squashfs/fragment.c
@@ -49,11 +49,16 @@ int squashfs_frag_lookup(struct super_block *sb, unsigned int fragment,
                                u64 *fragment_block)
 {
        struct squashfs_sb_info *msblk = sb->s_fs_info;
-       int block = SQUASHFS_FRAGMENT_INDEX(fragment);
-       int offset = SQUASHFS_FRAGMENT_INDEX_OFFSET(fragment);
-       u64 start_block = le64_to_cpu(msblk->fragment_index[block]);
+       int block, offset, size;
        struct squashfs_fragment_entry fragment_entry;
-       int size;
+       u64 start_block;
+
+       if (fragment >= msblk->fragments)
+               return -EIO;
+       block = SQUASHFS_FRAGMENT_INDEX(fragment);
+       offset = SQUASHFS_FRAGMENT_INDEX_OFFSET(fragment);
+
+       start_block = le64_to_cpu(msblk->fragment_index[block]);
 
        size = squashfs_read_metadata(sb, &fragment_entry, &start_block,
                                        &offset, sizeof(fragment_entry));

diff --git a/fs/squashfs/squashfs_fs_sb.h b/fs/squashfs/squashfs_fs_sb.h
index 1da565cb50c3d0f1e652671dd7a81577b598ca2f..ef69c31947bf86c06e138015c86d77e7c7727754 100644 (file)
--- a/fs/squashfs/squashfs_fs_sb.h
+++ b/fs/squashfs/squashfs_fs_sb.h
@@ -75,6 +75,7 @@ struct squashfs_sb_info {
        unsigned short                          block_log;
        long long                               bytes_used;
        unsigned int                            inodes;
+       unsigned int                            fragments;
        int                                     xattr_ids;
 };
 #endif

diff --git a/fs/squashfs/super.c b/fs/squashfs/super.c
index 8a73b97217c8a5fe24f0e30047354fe058644018..40e657386fa52d9e0358ff45dd949dede645d4e0 100644 (file)
--- a/fs/squashfs/super.c
+++ b/fs/squashfs/super.c
@@ -175,6 +175,7 @@ static int squashfs_fill_super(struct super_block *sb, void *data, int silent)
        msblk->inode_table = le64_to_cpu(sblk->inode_table_start);
        msblk->directory_table = le64_to_cpu(sblk->directory_table_start);
        msblk->inodes = le32_to_cpu(sblk->inodes);
+       msblk->fragments = le32_to_cpu(sblk->fragments);
        flags = le16_to_cpu(sblk->flags);
 
        TRACE("Found valid superblock on %pg\n", sb->s_bdev);
@@ -185,7 +186,7 @@ static int squashfs_fill_super(struct super_block *sb, void *data, int silent)
        TRACE("Filesystem size %lld bytes\n", msblk->bytes_used);
        TRACE("Block size %d\n", msblk->block_size);
        TRACE("Number of inodes %d\n", msblk->inodes);
-       TRACE("Number of fragments %d\n", le32_to_cpu(sblk->fragments));
+       TRACE("Number of fragments %d\n", msblk->fragments);
        TRACE("Number of ids %d\n", le16_to_cpu(sblk->no_ids));
        TRACE("sblk->inode_table_start %llx\n", msblk->inode_table);
        TRACE("sblk->directory_table_start %llx\n", msblk->directory_table);
@@ -272,7 +273,7 @@ allocate_id_index_table:
        sb->s_export_op = &squashfs_export_ops;
 
 handle_fragments:
-       fragments = le32_to_cpu(sblk->fragments);
+       fragments = msblk->fragments;
        if (fragments == 0)
                goto check_directory_table;