mirror of
https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git
synced 2026-10-06 03:45:24 -04:00
| Filename | Latest commit message | Latest commit date |
|---|---|---|
db7096ea16
[ Upstream commit 734aa85390ea693bb7eaf2240623d41b03705c84 ]
Syzkaller reports an "UBSAN: shift-out-of-bounds in squashfs_bio_read" bug.
Syzkaller forks multiple processes which after mounting the Squashfs
filesystem, issues an ioctl("/dev/loop0", LOOP_SET_BLOCK_SIZE, 0x8000).
Now if this ioctl occurs at the same time another process is in the
process of mounting a Squashfs filesystem on /dev/loop0, the failure
occurs. When this happens the following code in squashfs_fill_super()
fails.
----
msblk->devblksize = sb_min_blocksize(sb, SQUASHFS_DEVBLK_SIZE);
msblk->devblksize_log2 = ffz(~msblk->devblksize);
----
sb_min_blocksize() returns 0, which means msblk->devblksize is set to 0.
As a result, ffz(~msblk->devblksize) returns 64, and msblk->devblksize_log2
is set to 64.
This subsequently causes the
UBSAN: shift-out-of-bounds in fs/squashfs/block.c:195:36
shift exponent 64 is too large for 64-bit type 'u64' (aka
'unsigned long long')
This commit adds a check for a 0 return by sb_min_blocksize().
Link: https://lkml.kernel.org/r/20250409024747.876480-1-phillip@squashfs.org.uk
Fixes:
|
||
| .. | ||
| block.c | ||
| cache.c | ||
| decompressor.c | ||
| decompressor.h | ||
| decompressor_multi.c | ||
| decompressor_multi_percpu.c | ||
| decompressor_single.c | ||
| dir.c | ||
| export.c | ||
| file.c | ||
| file_cache.c | ||
| file_direct.c | ||
| fragment.c | ||
| id.c | ||
| inode.c | ||
| Kconfig | ||
| lz4_wrapper.c | ||
| lzo_wrapper.c | ||
| Makefile | ||
| namei.c | ||
| page_actor.c | ||
| page_actor.h | ||
| squashfs.h | ||
| squashfs_fs.h | ||
| squashfs_fs_i.h | ||
| squashfs_fs_sb.h | ||
| super.c | ||
| symlink.c | ||
| xattr.c | ||
| xattr.h | ||
| xattr_id.c | ||
| xz_wrapper.c | ||
| zlib_wrapper.c | ||
| zstd_wrapper.c | ||