Fedor Pchelkin cf5d661209 squashfs: harden sanity check in squashfs_read_xattr_id_table ... [ Upstream commit 72e544b1b2 ] While mounting a corrupted filesystem, a signed integer '*xattr_ids' can become less than zero. This leads to the incorrect computation of 'len' and 'indexes' values which can cause null-ptr-deref in copy_bio_to_actor() or out-of-bounds accesses in the next sanity checks inside squashfs_read_xattr_id_table(). Found by Linux Verification Center (linuxtesting.org) with Syzkaller. Link: https://lkml.kernel.org/r/20230117105226.329303-2-pchelkin@ispras.ru Fixes: 506220d2ba ("squashfs: add more sanity checks in xattr id lookup") Reported-by: <syzbot+082fa4af80a5bb1a9843@syzkaller.appspotmail.com> Signed-off-by: Fedor Pchelkin <pchelkin@ispras.ru> Signed-off-by: Alexey Khoroshilov <khoroshilov@ispras.ru> Cc: Phillip Lougher <phillip@squashfs.org.uk> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Sasha Levin <sashal@kernel.org>		2023-02-22 12:46:01 +01:00
..
9p	9p: missing chunk of "fs/9p: Don't update file type when updating file attributes"	2022-06-25 11:46:24 +02:00
adfs	fs/adfs: super: fix use-after-free bug	2019-08-06 19:05:21 +02:00
affs	affs: initialize fsdata in affs_truncate()	2023-02-06 07:46:28 +01:00
afs	afs: Fix some tracing details	2020-04-02 16:34:33 +02:00
autofs4	autofs: fix a leak in autofs_expire_indirect()	2019-12-17 20:37:24 +01:00
befs
bfs
btrfs	btrfs: qgroup: fix sleep from invalid context bug in btrfs_qgroup_inherit()	2022-12-08 11:16:32 +01:00
cachefiles	cachefiles: Handle readpage error correctly	2020-11-05 11:07:05 +01:00
ceph	ceph: don't truncate file in atomic_open	2022-10-26 13:16:53 +02:00
cifs	cifs: fix confusing debug message	2023-01-18 09:26:38 +01:00
coda	coda: add error handling for fget	2019-08-06 19:05:23 +02:00
configfs	configfs: fix a race in configfs_{,un}register_subsystem()	2022-03-02 11:33:56 +01:00
cramfs
crypto	fscrypt: don't ignore minor_hash when hash is 0	2021-07-20 16:17:45 +02:00
debugfs	debugfs: fix use-after-free on symlink traversal	2019-05-08 07:20:49 +02:00
devpts	fs/devpts: always delete dcache dentry-s in dput()	2019-03-23 14:35:21 +01:00
dlm	fs: dlm: handle -EBUSY first in lock arg validation	2022-10-26 13:16:55 +02:00
ecryptfs	Revert "ecryptfs: replace BUG_ON with error handling code"	2021-05-26 11:47:00 +02:00
efivarfs	efivarfs: revert "fix memory leak in efivarfs_create()"	2020-12-02 08:34:44 +01:00
efs
exofs	exofs_mount(): fix leaks on failure exits	2019-12-05 15:37:28 +01:00
exportfs	exportfs: fix 'passing zero to ERR_PTR()' warning	2020-01-27 14:46:06 +01:00
ext2	ext2: Add more validity checks for inode counts	2022-08-25 11:11:14 +02:00
ext4	ext4: allocate extended attribute value in vmalloc area	2023-01-18 09:26:40 +01:00
f2fs	f2fs: let's avoid panic if extent_tree is not created	2023-01-24 07:05:18 +01:00
fat	fat: add ratelimit to fat*_ent_bread()	2022-06-14 16:53:46 +02:00
freevxfs
fscache
fuse	fuse: limit nsec	2022-08-25 11:11:12 +02:00
gfs2	gfs2: Switch from strlcpy to strscpy	2022-11-25 17:36:55 +01:00
hfs	hfs/hfsplus: avoid WARN_ON() for sanity check, use proper error handling	2023-01-18 09:26:41 +01:00
hfsplus	hfs/hfsplus: use WARN_ON for sanity check	2023-01-18 09:26:41 +01:00
hostfs
hpfs
hugetlbfs	hugetlbfs: hugetlb_fault_mutex_hash() cleanup	2021-06-03 08:36:25 +02:00
isofs	isofs: Fix out of bound access for corrupted isofs image	2021-11-12 14:28:24 +01:00
jbd2	jbd2: fix assertion 'jh->b_frozen_data == NULL' failure when journal aborted	2022-08-25 11:11:23 +02:00
jffs2	jffs2: fix memory leak in jffs2_do_fill_super	2022-06-14 16:53:57 +02:00
jfs	fs: jfs: fix shift-out-of-bounds in dbDiscardAG	2023-01-18 09:26:30 +01:00
kernfs	kernfs: fix use-after-free in __kernfs_remove	2022-11-03 23:50:53 +09:00
lockd	lockd: don't use interval-based rebinding over TCP	2020-12-29 13:46:57 +01:00
minix	fs/minix: reject too-large maximum file size	2020-08-21 09:48:15 +02:00
ncpfs
nfs	pNFS/filelayout: Fix coalescing test for single DS	2023-01-24 07:05:18 +01:00
nfs_common	nfs_common: need lock during iterate through the list	2020-12-29 13:47:01 +01:00
nfsd	nfsd: fix handling of readdir in v4root vs. mount upcall timeout	2023-01-18 09:26:41 +01:00
nilfs2	nilfs2: fix general protection fault in nilfs_btree_insert()	2023-01-24 07:05:18 +01:00
nls
notify	fsnotify: fix wrong lockdep annotations	2022-06-14 16:53:48 +02:00
ntfs	ntfs: check overflow when iterating ATTR_RECORDs	2022-11-25 17:36:55 +01:00
ocfs2	ocfs2: fix memory leak in ocfs2_stack_glue_init()	2023-01-18 09:26:09 +01:00
omfs
openpromfs
orangefs	orangefs: Fix kmemleak in orangefs_prepare_debugfs_help_string()	2023-01-18 09:26:33 +01:00
overlayfs	ovl: fix missing negative dentry check in ovl_rename()	2021-10-17 10:08:32 +02:00
proc	sysctl: add a new register_sysctl_init() interface	2023-02-06 07:46:33 +01:00
pstore	pstore: Make sure CONFIG_PSTORE_PMSG selects CONFIG_RT_MUTEXES	2023-01-18 09:26:34 +01:00
qnx4	qnx4: work around gcc false positive warning bug	2021-10-06 15:05:08 +02:00
qnx6
quota	quota: Check next/prev free block number after reading from quota file	2022-10-26 13:16:56 +02:00
ramfs	ramfs: fix nommu mmap with gaps in the page cache	2020-10-29 09:07:11 +01:00
reiserfs	fs: reiserfs: remove useless new_opts in reiserfs_remount	2023-02-06 07:46:30 +01:00
romfs	romfs: fix uninitialized memory leak in romfs_dev_read()	2020-08-26 10:29:54 +02:00
squashfs	squashfs: harden sanity check in squashfs_read_xattr_id_table	2023-02-22 12:46:01 +01:00
sysfs	fs: sysfs_emit: Remove PAGE_SIZE alignment check	2022-03-23 09:01:35 +01:00
sysv	fs: sysv: Fix sysv_nblocks() returns wrong value	2023-01-18 09:26:11 +01:00
tracefs	tracefs: Only clobber mode/uid/gid on remount if asked	2022-09-20 11:51:31 +02:00
ubifs	ubifs: Rectify space amount budget for mkdir/tmpfile operations	2022-04-20 09:08:25 +02:00
udf	udf: Fix extension of the last extent in the file	2023-01-18 09:26:41 +01:00
ufs	fs/ufs: avoid potential u32 multiplication overflow	2020-08-21 09:48:22 +02:00
xfs	xfs: remove incorrect ASSERT in xfs_rename	2022-07-12 16:27:28 +02:00
aio.c
anon_inodes.c
attr.c	vfs: Check the truncate maximum size in inode_newsize_ok()	2022-08-25 11:11:11 +02:00
bad_inode.c
binfmt_aout.c
binfmt_elf.c	fs/binfmt_elf.c: allocate initialized memory in fill_thread_core_info()	2020-06-03 08:18:03 +02:00
binfmt_elf_fdpic.c
binfmt_em86.c
binfmt_flat.c	binfmt_flat: do not stop relocating GOT entries prematurely on riscv	2022-06-14 16:53:43 +02:00
binfmt_misc.c	binfmt_misc: fix shift-out-of-bounds in check_special_flags	2023-01-18 09:26:29 +01:00
binfmt_script.c	exec: load_script: Do not exec truncated interpreter path	2019-11-06 12:42:59 +01:00
block_dev.c	block: reexpand iov_iter after read/write	2021-05-22 10:57:43 +02:00
buffer.c	mm: fs: initialize fsdata passed to write_begin/write_end interface	2022-11-25 17:36:55 +01:00
char_dev.c	chardev: fix error handling in cdev_device_add()	2023-01-18 09:26:24 +01:00
compat.c
compat_binfmt_elf.c
compat_ioctl.c	fix compat handling of FICLONERANGE, FIDEDUPERANGE and FS_IOC_FIEMAP	2020-01-09 10:17:58 +01:00
coredump.c	coredump: fix crash when umh is disabled	2020-05-20 08:16:58 +02:00
dax.c	dax: pass NOWAIT flag to iomap_apply	2020-03-11 18:02:43 +01:00
dcache.c	fs/dcache: Fix incorrect nr_dentry_unused accounting in shrink_dcache_sb()	2019-02-06 17:31:34 +01:00
dcookies.c
direct-io.c	fs: direct-io: fix missing sdio->boundary	2021-04-16 11:57:48 +02:00
drop_caches.c	fs: avoid softlockups in s_inodes iterators	2020-01-12 12:11:59 +01:00
eventfd.c
eventpoll.c	ep_create_wakeup_source(): dentry name can change under you...	2020-10-14 09:51:09 +02:00
exec.c	exec: Force single empty string when argv is empty	2022-06-06 08:20:57 +02:00
fcntl.c
fhandle.c
file.c	fget: clarify and improve __fget_files() implementation	2022-03-02 11:34:00 +01:00
file_table.c	fs: add fget_many() and fput_many()	2021-12-08 08:46:55 +01:00
filesystems.c	fs/filesystems.c: downgrade user-reachable WARN_ONCE() to pr_warn_once()	2020-04-24 08:00:43 +02:00
fs-writeback.c	fs-writeback: writeback_sb_inodes：Recalculate 'wrote' according skipped pages	2022-06-14 16:53:52 +02:00
fs_pin.c
fs_struct.c
inode.c	fs: fix UAF/GPF bug in nilfs_mdt_destroy	2022-10-26 13:16:51 +02:00
internal.h
ioctl.c
iomap.c	iomap: Fix pipe page leakage during splicing	2019-12-17 20:38:57 +01:00
Kconfig
Kconfig.binfmt
libfs.c	libfs: add DEFINE_SIMPLE_ATTRIBUTE_SIGNED for signed value	2023-01-18 09:26:10 +01:00
locks.c	locks: print unsigned ino in /proc/locks	2020-01-09 10:17:55 +01:00
Makefile
mbcache.c
mount.h
mpage.c
namei.c	mm: fs: initialize fsdata passed to write_begin/write_end interface	2022-11-25 17:36:55 +01:00
namespace.c	VFS: Fix memory leak caused by concurrently mounting fs with subtype	2022-05-15 19:40:27 +02:00
no-block.c
nsfs.c
open.c	cifs_atomic_open(): fix double-put on late allocation failure	2020-03-20 10:54:16 +01:00
pipe.c	pipe: increase minimum default pipe size to 2 pages	2021-08-15 13:03:31 +02:00
pnode.c	pnode: terminate at peers of source	2023-01-18 09:26:35 +01:00
pnode.h
posix_acl.c
proc_namespace.c
read_write.c	vfs: avoid problematic remapping requests into partial EOF block	2019-12-01 09:13:51 +01:00
readdir.c	readdir: make sure to verify directory entry for legacy interfaces too	2021-04-28 12:08:41 +02:00
select.c	kernel, fs: Introduce and use set_restart_fn() and arch_set_restart_data()	2021-03-24 11:05:05 +01:00
seq_file.c	seq_file: disallow extremely large seq buffer allocations	2021-07-20 16:17:55 +02:00
signalfd.c	signalfd: use wake_up_pollfree()	2021-12-14 10:16:55 +01:00
splice.c	Revert "fs: check FMODE_LSEEK to control internal pipe splicing"	2022-10-26 13:16:56 +02:00
stack.c
stat.c	stat: fix inconsistency between struct stat and struct compat_stat	2022-04-27 13:15:30 +02:00
statfs.c	vfs: Fix EOVERFLOW testing in put_compat_statfs64	2019-10-11 18:18:48 +02:00
super.c	vfs: make freeze_super abort when sync_filesystem returns error	2022-02-23 11:57:33 +01:00
sync.c
timerfd.c
userfaultfd.c	userfaultfd: require CAP_SYS_PTRACE for UFFD_FEATURE_EVENT_FORK	2020-01-04 13:59:58 +01:00
utimes.c
xattr.c	fs: don't audit the capability check in simple_xattr_list()	2023-01-18 09:26:09 +01:00