Phillip Lougher 875fb3f87a Squashfs: reject negative file sizes in squashfs_read_inode() ...

[ Upstream commit 9f1c14c1de1bdde395f6cc893efa4f80a2ae3b2b ]

Syskaller reports a "WARNING in ovl_copy_up_file" in overlayfs.

This warning is ultimately caused because the underlying Squashfs file
system returns a file with a negative file size.

This commit checks for a negative file size and returns EINVAL.

[phillip@squashfs.org.uk: only need to check 64 bit quantity]
  Link: https://lkml.kernel.org/r/20250926222305.110103-1-phillip@squashfs.org.uk
Link: https://lkml.kernel.org/r/20250926215935.107233-1-phillip@squashfs.org.uk
Fixes: 6545b246a2 ("Squashfs: inode operations")
Signed-off-by: Phillip Lougher <phillip@squashfs.org.uk>
Reported-by: syzbot+f754e01116421e9754b9@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/all/68d580e5.a00a0220.303701.0019.GAE@google.com/
Cc: Amir Goldstein <amir73il@gmail.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

2025-10-19 16:34:00 +02:00

..

block.c

squashfs: squashfs_read_data need to check if the length is 0

2023-12-06 16:12:45 -08:00

cache.c

…

decompressor_multi_percpu.c

squashfs: fix percpu address space issues in decompressor_multi_percpu.c

2024-09-09 16:47:41 -07:00

decompressor_multi.c

squashfs: allows users to configure the number of decompression threads

2022-11-18 13:55:08 -08:00

decompressor_single.c

squashfs: add the mount parameter theads=<single|multi|percpu>

2022-11-18 13:55:08 -08:00

decompressor.c

squashfs: don't include buffer_head.h

2023-06-09 17:44:14 -07:00

decompressor.h

…

dir.c

…

export.c

exportfs: make ->encode_fh() a mandatory method for NFS export

2023-10-28 16:15:15 +02:00

file_cache.c

…

file_direct.c

Squashfs: fix variable overflow in squashfs_readpage_block

2024-10-30 20:14:12 -07:00

file.c

Squashfs: Ensure all readahead pages have been used

2024-08-23 13:11:36 +02:00

fragment.c

…

id.c

…

inode.c

Squashfs: reject negative file sizes in squashfs_read_inode()

2025-10-19 16:34:00 +02:00

Kconfig

squashfs: allows users to configure the number of decompression threads

2022-11-18 13:55:08 -08:00

lz4_wrapper.c

…

lzo_wrapper.c

…

Makefile

squashfs: always build "file direct" version of page actor

2022-07-29 18:12:34 -07:00

namei.c

Squashfs: remove deprecated strncpy by not copying the string

2024-04-25 21:07:05 -07:00

page_actor.c

Squashfs: Update page_actor to not use page->index

2024-08-19 14:08:20 +02:00

page_actor.h

Squashfs: Ensure all readahead pages have been used

2024-08-23 13:11:36 +02:00

squashfs_fs_i.h

Squashfs: fix uninit-value in squashfs_get_parent

2025-10-15 12:00:20 +02:00

squashfs_fs_sb.h

squashfs: cache partial compressed blocks

2023-06-09 17:44:14 -07:00

squashfs_fs.h

Squashfs: fix handling and sanity checking of xattr_ids count

2023-01-31 16:44:10 -08:00

squashfs.h

squashfs: move squashfs_xattr_handlers to .rodata

2023-10-10 13:49:20 +02:00

super.c

squashfs: fix memory leak in squashfs_fill_super

2025-08-28 16:31:05 +02:00

symlink.c

squashfs: convert squashfs_symlink_read_folio to use folio APIs

2024-05-08 08:41:28 -07:00

xattr_id.c

revert "squashfs: harden sanity check in squashfs_read_xattr_id_table"

2023-02-03 17:52:25 -08:00

xattr.c

squashfs: move squashfs_xattr_handlers to .rodata

2023-10-10 13:49:20 +02:00

xattr.h

Squashfs: fix handling and sanity checking of xattr_ids count

2023-01-31 16:44:10 -08:00

xz_wrapper.c

…

zlib_wrapper.c

…

zstd_wrapper.c

…