squashfs: more metadata hardening
authorLinus Torvalds <torvalds@linux-foundation.org>
Thu, 2 Aug 2018 15:43:35 +0000 (08:43 -0700)
committerLinus Torvalds <torvalds@linux-foundation.org>
Thu, 2 Aug 2018 16:32:23 +0000 (09:32 -0700)
commit71755ee5350b63fb1f283de8561cdb61b47f4d1d
treecfca6c7e5f8f30014724b955c845a1a2e80d95e5
parent6b4703768268d09ac928c64474fd686adf4574f9
squashfs: more metadata hardening

The squashfs fragment reading code doesn't actually verify that the
fragment is inside the fragment table.  The end result _is_ verified to
be inside the image when actually reading the fragment data, but before
that is done, we may end up taking a page fault because the fragment
table itself might not even exist.

Another report from Anatoly and his endless squashfs image fuzzing.

Reported-by: Анатолий Тросиненко <anatoly.trosinenko@gmail.com>
Acked-by:: Phillip Lougher <phillip.lougher@gmail.com>,
Cc: Willy Tarreau <w@1wt.eu>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
fs/squashfs/fragment.c
fs/squashfs/squashfs_fs_sb.h
fs/squashfs/super.c