From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-7.0 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI, SIGNED_OFF_BY,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED autolearn=no autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 40FF5C433EC for ; Fri, 24 Jul 2020 04:15:43 +0000 (UTC) Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by mail.kernel.org (Postfix) with ESMTP id 0707B2064B for ; Fri, 24 Jul 2020 04:15:43 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (1024-bit key) header.d=kernel.org header.i=@kernel.org header.b="r7s0dXBL" DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 0707B2064B Authentication-Results: mail.kernel.org; dmarc=none (p=none dis=none) header.from=linux-foundation.org Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=owner-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix) id ACB728D0011; Fri, 24 Jul 2020 00:15:42 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id A7CC98D0007; Fri, 24 Jul 2020 00:15:42 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 96A238D0011; Fri, 24 Jul 2020 00:15:42 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0069.hostedemail.com [216.40.44.69]) by kanga.kvack.org (Postfix) with ESMTP id 8207A8D0007 for ; Fri, 24 Jul 2020 00:15:42 -0400 (EDT) Received: from smtpin18.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay05.hostedemail.com (Postfix) with ESMTP id 4C7E51802CCC1 for ; Fri, 24 Jul 2020 04:15:42 +0000 (UTC) X-FDA: 77071655724.18.edge80_470fb5c26f44 Received: from filter.hostedemail.com (10.5.16.251.rfc1918.com [10.5.16.251]) by smtpin18.hostedemail.com (Postfix) with ESMTP id 225DE100EC69A for ; Fri, 24 Jul 2020 04:15:42 +0000 (UTC) X-HE-Tag: edge80_470fb5c26f44 X-Filterd-Recvd-Size: 2958 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by imf16.hostedemail.com (Postfix) with ESMTP for ; Fri, 24 Jul 2020 04:15:41 +0000 (UTC) Received: from localhost.localdomain (c-73-231-172-41.hsd1.ca.comcast.net [73.231.172.41]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 677FB2064C; Fri, 24 Jul 2020 04:15:40 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1595564140; bh=4FftRsrLnSVZlOac7ovP38tViYU+X9KzWfXXsW9BEws=; h=Date:From:To:Subject:In-Reply-To:From; b=r7s0dXBLMCUJmNXoDlBkxLlQTfmhApl6t9qEazRcu5YtZMKgNpRX2PA/SoPj2dL2T 8+k2CDC/nW2m8MLx6AbrwR2bkPQvDkdSUWGqpIzxCAHgjwFEvfWFt+/pVTTxilG9RK uiEQcYbAL2h2vmxOEipyEIBiuwU8SH5j7b1ZLKIc= Date: Thu, 23 Jul 2020 21:15:40 -0700 From: Andrew Morton To: adrien+dev@schischi.me, akpm@linux-foundation.org, bernd.amend@gmail.com, drosen@google.com, groeck@chromium.org, hch@lst.de, linux-mm@kvack.org, mm-commits@vger.kernel.org, phillip@squashfs.org.uk, torvalds@linux-foundation.org Subject: [patch 11/15] squashfs: fix length field overlap check in metadata reading Message-ID: <20200724041540.wz6q4aH2w%akpm@linux-foundation.org> In-Reply-To: <20200723211432.b31831a0df3bc2cbdae31b40@linux-foundation.org> User-Agent: s-nail v14.8.16 X-Rspamd-Queue-Id: 225DE100EC69A X-Spamd-Result: default: False [0.00 / 100.00] X-Rspamd-Server: rspam05 X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: From: Phillip Lougher Subject: squashfs: fix length field overlap check in metadata reading This is a regression introduced by the "migrate from ll_rw_block usage to BIO" patch. Squashfs packs structures on byte boundaries, and due to that the length field (of the metadata block) may not be fully in the current block. The new code rewrote and introduced a faulty check for that edge case. Link: http://lkml.kernel.org/r/20200717195536.16069-1-phillip@squashfs.org.uk Fixes: 93e72b3c612adcaca1 ("squashfs: migrate from ll_rw_block usage to BIO") Signed-off-by: Phillip Lougher Reported-by: Bernd Amend Cc: Christoph Hellwig Cc: Adrien Schildknecht Cc: Guenter Roeck Cc: Daniel Rosenberg Signed-off-by: Andrew Morton --- fs/squashfs/block.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/fs/squashfs/block.c~squashfs-fix-length-field-overlap-check-in-metadata-reading +++ a/fs/squashfs/block.c @@ -175,7 +175,7 @@ int squashfs_read_data(struct super_bloc /* Extract the length of the metadata block */ data = page_address(bvec->bv_page) + bvec->bv_offset; length = data[offset]; - if (offset <= bvec->bv_len - 1) { + if (offset < bvec->bv_len - 1) { length |= data[offset + 1] << 8; } else { if (WARN_ON_ONCE(!bio_next_segment(bio, &iter_all))) { _