Repository files (latest commit first)

Filename	Latest commit message	Latest commit date
Phillip Lougher f81a5bc9e9 Squashfs: fix uninit-value in squashfs_get_parent ... commit 74058c0a9fc8b2b4d5f4a0ef7ee2cfa66a9e49cf upstream. Syzkaller reports a "KMSAN: uninit-value in squashfs_get_parent" bug. This is caused by open_by_handle_at() being called with a file handle containing an invalid parent inode number. In particular the inode number is that of a symbolic link, rather than a directory. Squashfs_get_parent() gets called with that symbolic link inode, and accesses the parent member field. unsigned int parent_ino = squashfs_i(inode)->parent; Because non-directory inodes in Squashfs do not have a parent value, this is uninitialised, and this causes an uninitialised value access. The fix is to initialise parent with the invalid inode 0, which will cause an EINVAL error to be returned. Regular inodes used to share the parent field with the block_list_start field. This is removed in this commit to enable the parent field to contain the invalid inode number 0. Link: https://lkml.kernel.org/r/20250918233308.293861-1-phillip@squashfs.org.uk Fixes: 122601408d ("Squashfs: export operations") Signed-off-by: Phillip Lougher <phillip@squashfs.org.uk> Reported-by: syzbot+157bdef5cf596ad0da2c@syzkaller.appspotmail.com Closes: https://lore.kernel.org/all/68cc2431.050a0220.139b6.0001.GAE@google.com/ Cc: <stable@vger.kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2025-10-29 13:59:50 +01:00
..
9p	fs/9p: drop inodes immediately on non-.L too	2024-05-17 11:43:53 +02:00
adfs
affs	affs: don't write overlarge OFS data block size fields	2025-04-10 14:29:42 +02:00
afs	afs: Fix directory format encoding struct	2025-03-13 12:42:52 +01:00
autofs	autofs: fix memory leak of waitqueues in autofs_catatonic_mode	2023-09-23 11:00:02 +02:00
befs
bfs
btrfs	btrfs: populate otime when logging an inode item	2025-08-28 16:21:35 +02:00
cachefiles	cachefiles: fix memory leak in cachefiles_add_cache()	2024-03-06 14:36:10 +00:00
ceph	ceph: fix possible integer overflow in ceph_zero_objects()	2025-07-17 18:24:50 +02:00
cifs	cifs: fix integer overflow in match_server()	2025-09-09 18:44:02 +02:00
coda
configfs	configfs: Do not override creating attribute file failure in populate_attrs()	2025-06-27 11:02:50 +01:00
cramfs
crypto
debugfs	new helper: lookup_positive_unlocked()	2023-09-23 10:59:40 +02:00
devpts
dlm	dlm: fix plock lookup when using multiple lockspaces	2023-09-23 10:59:55 +02:00
ecryptfs	ecryptfs: Fix buffer size for tag 66 packet	2024-06-16 13:28:32 +02:00
efivarfs	efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare	2025-09-04 14:05:55 +02:00
efs
erofs	erofs: fix incorrect symlink detection in fast symlink	2025-01-09 13:23:27 +01:00
exportfs
ext2	ext2: fix datatype of block number in ext2_xattr_set2()	2023-09-23 11:00:04 +02:00
ext4	ext4: fix reserved gdt blocks handling in fsmap	2025-08-28 16:21:31 +02:00
f2fs	f2fs: fix to avoid out-of-boundary access in dnode page	2025-08-28 16:21:35 +02:00
fat	fat: fix uninitialized variable	2024-11-08 16:20:47 +01:00
freevxfs
fscache
fuse	fuse: prevent overflow in copy_file_range return value	2025-10-02 13:34:28 +02:00
gfs2	gfs2: move msleep to sleepable context	2025-06-27 11:02:50 +01:00
hfs	hfs: fix not erasing deleted b-tree node issue	2025-08-28 16:21:24 +02:00
hfsplus	hfsplus: don't use BUG_ON() in hfsplus_create_attributes_file()	2025-08-28 16:21:24 +02:00
hostfs
hpfs
hugetlbfs	mm/hugetlb: fix folio is still mapped when deleted	2025-10-02 13:34:35 +02:00
iomap	iomap: Set all uptodate bits for an Uptodate page	2024-03-01 13:13:35 +01:00
isofs	isofs: Verify inode mode when loading from disk	2025-08-28 16:21:15 +02:00
jbd2	jbd2: prevent softlockup in jbd2_log_do_checkpoint()	2025-08-28 16:21:31 +02:00
jffs2	jffs2: check jffs2_prealloc_raw_node_refs() result in few other places	2025-06-27 11:02:56 +01:00
jfs	jfs: upper bound check of tree index in dbAllocAG	2025-08-28 16:21:28 +02:00
kernfs	fs/kernfs/dir: obey S_ISGID	2024-02-23 08:25:03 +01:00
lockd	fs: lockd: avoid possible wrong NULL parameter	2023-09-23 10:59:48 +02:00
minix
nfs	NFSv4.1: fix backchannel max_resp_sz verification check	2025-10-29 13:59:49 +01:00
nfs_common
nfsd	nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm()	2025-08-28 16:21:34 +02:00
nilfs2	nilfs2: fix CFI failure when accessing /sys/fs/nilfs2/features/*	2025-10-02 13:34:31 +02:00
nls	fs/nls: make load_nls() take a const parameter	2023-09-23 10:59:38 +02:00
notify	fanotify: disallow mount/sb marks on kernel internal pseudo fs	2023-07-27 08:37:26 +02:00
ntfs
ocfs2	ocfs2: fix double free in user_cluster_connect()	2025-10-29 13:59:49 +01:00
omfs
openpromfs	openpromfs: finish conversion to the new mount API	2024-06-16 13:28:32 +02:00
orangefs	fs/orangefs: use snprintf() instead of sprintf()	2025-08-28 16:21:27 +02:00
overlayfs	ovl: Check for NULL d_inode() in ovl_dentry_upper()	2025-07-17 18:24:51 +02:00
proc	fix proc_sys_compare() handling of in-lookup dentries	2025-07-17 18:25:01 +02:00
pstore	pstore/ram: Fix crash when setting number of cpus to an odd number	2024-02-23 08:24:55 +01:00
qnx4
qnx6
quota	quota: flush quota_release_work upon quota writeback	2024-12-14 19:44:42 +01:00
ramfs
reiserfs	reiserfs: Check the return value from __getblk()	2023-09-23 10:59:40 +02:00
romfs
squashfs	Squashfs: fix uninit-value in squashfs_get_parent	2025-10-29 13:59:50 +01:00
sysfs	fs: sysfs: Fix reference leak in sysfs_break_active_protection()	2024-05-02 16:18:32 +02:00
sysv	sysv: don't call sb_bread() with pointers_lock held	2024-04-13 12:51:38 +02:00
tracefs	tracefs: Add missing lockdown check to tracefs_create_dir()	2023-09-23 11:00:06 +02:00
ubifs	ubifs: skip dumping tnc tree when zroot is null	2025-03-13 12:42:59 +01:00
udf	udf: Verify partition map count	2025-08-28 16:21:24 +02:00
ufs
unicode	Revert "unicode: Don't special case ignorable code points"	2024-12-14 19:44:55 +01:00
verity	fsverity: skip PKCS#7 parser when keyring is empty	2023-09-23 10:59:55 +02:00
xfs	xfs: don't drop errno values when we fail to ficlone the entire range	2024-12-19 18:05:03 +01:00
aio.c	fs/aio: Check IOCB_AIO_RW before the struct aio_kiocb conversion	2024-04-13 12:51:29 +02:00
anon_inodes.c
attr.c	attr: block mode changes of symlinks	2023-09-23 11:00:06 +02:00
bad_inode.c
binfmt_aout.c
binfmt_elf.c
binfmt_elf_fdpic.c	fs: binfmt_elf_efpic: don't use missing interpreter's properties	2024-09-04 13:14:54 +02:00
binfmt_em86.c
binfmt_flat.c	binfmt_flat: Fix integer overflow bug on 32 bit systems	2025-03-13 12:43:07 +01:00
binfmt_misc.c	binfmt_misc: cleanup on filesystem umount	2024-09-04 13:14:53 +02:00
binfmt_script.c
block_dev.c	block: Don't invalidate pagecache for invalid falloc modes	2024-01-08 11:29:48 +01:00
buffer.c	fs/buffer: fix use-after-free when call bh_read() helper	2025-08-28 16:21:32 +02:00
char_dev.c
compat.c
compat_binfmt_elf.c
compat_ioctl.c	lsm: new security_file_ioctl_compat() hook	2024-02-23 08:25:15 +01:00
coredump.c	coredump: hand a pidfd to the usermode coredump helper	2025-06-04 14:32:36 +02:00
d_path.c
dax.c
dcache.c	fs: better handle deep ancestor chains in is_subdir()	2024-07-27 10:38:32 +02:00
dcookies.c
direct-io.c
drop_caches.c
eventfd.c	eventfd: prevent underflow for eventfd semaphores	2023-09-23 10:59:40 +02:00
eventpoll.c	epoll: Add synchronous wakeup support for ep_poll_callback	2025-01-09 13:23:32 +01:00
exec.c	parisc: Fix stack start for ADDR_NO_RANDOMIZE personality	2024-11-08 16:20:40 +01:00
fcntl.c	fs: Fix file_set_fowner LSM hook inconsistencies	2024-11-08 16:20:34 +01:00
fhandle.c	do_sys_name_to_handle(): use kzalloc() to fix kernel-infoleak	2024-03-26 18:22:13 -04:00
file.c	alloc_fdtable(): change calling conventions.	2025-08-28 16:21:37 +02:00
file_table.c
filesystems.c	fs/filesystems: Fix potential unsigned integer underflow in fs_name()	2025-06-27 11:02:50 +01:00
fs-writeback.c
fs_context.c
fs_parser.c
fs_pin.c
fs_struct.c
fs_types.c
fsopen.c
inode.c	vfs: fix race between evice_inodes() and find_inode()&iput()	2024-11-08 16:20:34 +01:00
internal.h	fs: Establish locking order for unrelated directories	2023-07-27 08:37:26 +02:00
io_uring.c	io_uring: fail NOP if non-zero op flags is passed in	2024-06-16 13:28:48 +02:00
ioctl.c
Kconfig	nfs: add missing selections of CONFIG_CRC32	2025-05-02 07:39:20 +02:00
Kconfig.binfmt
libfs.c
locks.c	filelock: Correct the filelock owner in fcntl_setlk/fcntl_setlk64	2024-09-04 13:15:02 +02:00
Makefile
mbcache.c
mount.h
mpage.c
namei.c	fuse: don't truncate cached, mutated symlink	2025-04-10 14:29:36 +02:00
namespace.c	use uniform permission checks for all mount propagation changes	2025-08-28 16:21:32 +02:00
no-block.c
nsfs.c
open.c	ftruncate: pass a signed offset	2024-07-05 09:08:31 +02:00
pipe.c
pnode.c
pnode.h
posix_acl.c
proc_namespace.c
read_write.c
readdir.c
select.c	fs/select: rework stack allocation hack for clang	2024-03-26 18:22:13 -04:00
seq_file.c
signalfd.c
splice.c
stack.c
stat.c
statfs.c
super.c	fs: explicitly unregister per-superblock BDIs	2024-11-08 16:20:26 +01:00
sync.c	ovl: skip overlayfs superblocks at global sync	2023-12-08 08:44:27 +01:00
timerfd.c
userfaultfd.c
utimes.c
xattr.c