Messages in this thread Patch in this message | | | From | Fox Chen <> | Subject | [PATCH] squashfs: Add id_table sanity check to squashfs_get_id | Date | Tue, 3 Nov 2020 10:04:31 +0800 |
| |
When uid/gid info in superblocks or id_index_table is corrupted, The uid/gid index can be larger than the size of msblk->id_table. This is reported by syzkaller.
This patch adds a sanity check to squashfs_get_id which calculates the max available room for uid/gid table by doing msblk->xattr_table - msblk->id_table[0] and check if index is larger than this.
While this provides some sort of check, it is imperfect because id_table can be smaller than that.
Reported-by: syzbot+8e28bba73ed1772a6802@syzkaller.appspotmail.com Signed-off-by: Fox Chen <foxhlchen@gmail.com> --- fs/squashfs/id.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
diff --git a/fs/squashfs/id.c b/fs/squashfs/id.c index 6be5afe7287d..81bd67c0f649 100644 --- a/fs/squashfs/id.c +++ b/fs/squashfs/id.c @@ -35,10 +35,16 @@ int squashfs_get_id(struct super_block *sb, unsigned int index, struct squashfs_sb_info *msblk = sb->s_fs_info; int block = SQUASHFS_ID_BLOCK(index); int offset = SQUASHFS_ID_BLOCK_OFFSET(index); - u64 start_block = le64_to_cpu(msblk->id_table[block]); + u64 start_block; __le32 disk_id; int err; + // sanity check + if (le64_to_cpu(msblk->id_table[0]) + block >= msblk->xattr_table) + return -EINVAL; + + start_block = le64_to_cpu(msblk->id_table[block]); + err = squashfs_read_metadata(sb, &disk_id, &start_block, &offset, sizeof(disk_id)); if (err < 0) -- 2.25.1
| |