No description
  • C 98.2%
  • Assembly 1%
  • Makefile 0.3%
  • Shell 0.2%
  • Python 0.1%
Find a file
Repository files (latest commit first)
Filename Latest commit message Latest commit date
Phillip Lougher f81a5bc9e9 Squashfs: fix uninit-value in squashfs_get_parent
commit 74058c0a9fc8b2b4d5f4a0ef7ee2cfa66a9e49cf upstream.

Syzkaller reports a "KMSAN: uninit-value in squashfs_get_parent" bug.

This is caused by open_by_handle_at() being called with a file handle
containing an invalid parent inode number.  In particular the inode number
is that of a symbolic link, rather than a directory.

Squashfs_get_parent() gets called with that symbolic link inode, and
accesses the parent member field.

	unsigned int parent_ino = squashfs_i(inode)->parent;

Because non-directory inodes in Squashfs do not have a parent value, this
is uninitialised, and this causes an uninitialised value access.

The fix is to initialise parent with the invalid inode 0, which will cause
an EINVAL error to be returned.

Regular inodes used to share the parent field with the block_list_start
field.  This is removed in this commit to enable the parent field to
contain the invalid inode number 0.

Link: https://lkml.kernel.org/r/20250918233308.293861-1-phillip@squashfs.org.uk
Fixes: 122601408d ("Squashfs: export operations")
Signed-off-by: Phillip Lougher <phillip@squashfs.org.uk>
Reported-by: syzbot+157bdef5cf596ad0da2c@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/all/68cc2431.050a0220.139b6.0001.GAE@google.com/
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-10-29 13:59:50 +01:00
arch sparc: fix accurate exception reporting in copy_{from,to}_user for M7 2025-10-29 13:59:49 +01:00
block block: use int to store blk_stack_limits() return value 2025-10-29 13:59:46 +01:00
certs
crypto
Documentation
drivers Revert "net/mlx5e: Update and set Xon/Xoff upon MTU set" 2025-10-29 13:59:50 +01:00
fs Squashfs: fix uninit-value in squashfs_get_parent 2025-10-29 13:59:50 +01:00
include driver core/PM: Set power.no_callbacks along with power.no_pm 2025-10-29 13:59:46 +01:00
init
ipc
kernel cgroup: split cgroup_destroy_wq into 3 workqueues 2025-10-02 13:34:30 +02:00
lib
LICENSES
mm mm/migrate_device: don't add folio to be freed to LRU in migrate_device_finalize() 2025-10-02 13:34:34 +02:00
net ipvs: Defer ip_vs_ftp unregister during netns cleanup 2025-10-29 13:59:49 +01:00
samples
scripts
security
sound ASoC: Intel: bytcr_rt5651: Fix invalid quirk input mapping 2025-10-29 13:59:48 +01:00
tools selftests: watchdog: skip ping loop if WDIOF_KEEPALIVEPING not supported 2025-10-29 13:59:46 +01:00
usr
virt
.clang-format
.cocciconfig
.get_maintainer.ignore
.gitattributes
.gitignore
.mailmap
COPYING
CREDITS
Kbuild
Kconfig
MAINTAINERS
Makefile Linux 5.4.300 2025-10-02 13:34:35 +02:00
README

Linux kernel
============

There are several guides for kernel developers and users. These guides can
be rendered in a number of formats, like HTML and PDF. Please read
Documentation/admin-guide/README.rst first.

In order to build the documentation, use ``make htmldocs`` or
``make pdfdocs``.  The formatted documentation can also be read online at:

    https://www.kernel.org/doc/html/latest/

There are various text files in the Documentation/ subdirectory,
several of them using the Restructured Text markup notation.

Please read the Documentation/process/changes.rst file, as it contains the
requirements for building and running the kernel, and information about
the problems which may result by upgrading your kernel.