squashfs: harden sanity check in squashfs_read_xattr_id_table
While mounting a corrupted filesystem, a signed integer '*xattr_ids' can become less than zero. This leads to the incorrect computation of 'len' and 'indexes' values which can cause null-ptr-deref in copy_bio_to_actor() or out-of-bounds accesses in the next sanity checks inside squashfs_read_xattr_id_table(). Found by Linux Verification Center (linuxtesting.org) with Syzkaller. Link: https://lkml.kernel.org/r/20230117105226.329303-2-pchelkin@ispras.ru Fixes: 506220d2 ("squashfs: add more sanity checks in xattr id lookup") Reported-by: <syzbot+082fa4af80a5bb1a9843@syzkaller.appspotmail.com> Signed-off-by: Fedor Pchelkin <pchelkin@ispras.ru> Signed-off-by: Alexey Khoroshilov <khoroshilov@ispras.ru> Cc: Phillip Lougher <phillip@squashfs.org.uk> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
parent
6f28a261
-
mentioned in commit b7398efe
-
mentioned in commit a5b21d8d
-
mentioned in commit cf5d6612
-
mentioned in commit ea09332b
-
mentioned in commit b30a74f8
-
mentioned in commit 2ab96a0e
-
mentioned in commit 3a63392c
-
mentioned in commit 65d07ae6
-
mentioned in commit 32d81fd5
-
mentioned in commit b5aa09a0
Please register or sign in to comment