Commit 8563f8786ee389c7861938d1d25336706f6de187
Exists in
smarc-l5.0.0_1.0.0-ga
and in
5 other branches
Merge tag 'squashfs-updates' of git://git.kernel.org/pub/scm/linux/kernel/git/pkl/squashfs-next
Pull squashfs updates from Phillip Lougher: "Add an extra mount time sanity check, plus some code cleanups and bug fixes." * tag 'squashfs-updates' of git://git.kernel.org/pub/scm/linux/kernel/git/pkl/squashfs-next: Squashfs: add mount time sanity check for block_size and block_log match Squashfs: fix f_pos check in get_dir_index_using_offset Squashfs: get rid of obsolete definitions in header file Squashfs: remove redundant length initialisation in squashfs_lookup Squashfs: remove redundant length initialisation in squashfs_readdir Squashfs: update comment removing reference to zlib only Squashfs: use define instead of constant
Showing 5 changed files Side-by-side Diff
fs/squashfs/block.c
... | ... | @@ -83,7 +83,8 @@ |
83 | 83 | * filesystem), otherwise the length is obtained from the first two bytes of |
84 | 84 | * the metadata block. A bit in the length field indicates if the block |
85 | 85 | * is stored uncompressed in the filesystem (usually because compression |
86 | - * generated a larger block - this does occasionally happen with zlib). | |
86 | + * generated a larger block - this does occasionally happen with compression | |
87 | + * algorithms). | |
87 | 88 | */ |
88 | 89 | int squashfs_read_data(struct super_block *sb, void **buffer, u64 index, |
89 | 90 | int length, u64 *next_index, int srclength, int pages) |
fs/squashfs/dir.c
... | ... | @@ -64,7 +64,7 @@ |
64 | 64 | * is offset by 3 because we invent "." and ".." entries which are |
65 | 65 | * not actually stored in the directory. |
66 | 66 | */ |
67 | - if (f_pos < 3) | |
67 | + if (f_pos <= 3) | |
68 | 68 | return f_pos; |
69 | 69 | f_pos -= 3; |
70 | 70 | |
... | ... | @@ -105,7 +105,7 @@ |
105 | 105 | struct inode *inode = file->f_dentry->d_inode; |
106 | 106 | struct squashfs_sb_info *msblk = inode->i_sb->s_fs_info; |
107 | 107 | u64 block = squashfs_i(inode)->start + msblk->directory_table; |
108 | - int offset = squashfs_i(inode)->offset, length = 0, dir_count, size, | |
108 | + int offset = squashfs_i(inode)->offset, length, dir_count, size, | |
109 | 109 | type, err; |
110 | 110 | unsigned int inode_number; |
111 | 111 | struct squashfs_dir_header dirh; |
... | ... | @@ -173,8 +173,7 @@ |
173 | 173 | |
174 | 174 | dir_count = le32_to_cpu(dirh.count) + 1; |
175 | 175 | |
176 | - /* dir_count should never be larger than 256 */ | |
177 | - if (dir_count > 256) | |
176 | + if (dir_count > SQUASHFS_DIR_COUNT) | |
178 | 177 | goto failed_read; |
179 | 178 | |
180 | 179 | while (dir_count--) { |
fs/squashfs/namei.c
... | ... | @@ -144,7 +144,7 @@ |
144 | 144 | struct squashfs_dir_entry *dire; |
145 | 145 | u64 block = squashfs_i(dir)->start + msblk->directory_table; |
146 | 146 | int offset = squashfs_i(dir)->offset; |
147 | - int err, length = 0, dir_count, size; | |
147 | + int err, length, dir_count, size; | |
148 | 148 | |
149 | 149 | TRACE("Entered squashfs_lookup [%llx:%x]\n", block, offset); |
150 | 150 | |
... | ... | @@ -177,8 +177,7 @@ |
177 | 177 | |
178 | 178 | dir_count = le32_to_cpu(dirh.count) + 1; |
179 | 179 | |
180 | - /* dir_count should never be larger than 256 */ | |
181 | - if (dir_count > 256) | |
180 | + if (dir_count > SQUASHFS_DIR_COUNT) | |
182 | 181 | goto data_error; |
183 | 182 | |
184 | 183 | while (dir_count--) { |
fs/squashfs/squashfs_fs.h
... | ... | @@ -30,12 +30,7 @@ |
30 | 30 | |
31 | 31 | /* size of metadata (inode and directory) blocks */ |
32 | 32 | #define SQUASHFS_METADATA_SIZE 8192 |
33 | -#define SQUASHFS_METADATA_LOG 13 | |
34 | 33 | |
35 | -/* default size of data blocks */ | |
36 | -#define SQUASHFS_FILE_SIZE 131072 | |
37 | -#define SQUASHFS_FILE_LOG 17 | |
38 | - | |
39 | 34 | /* default size of block device I/O */ |
40 | 35 | #ifdef CONFIG_SQUASHFS_4K_DEVBLK_SIZE |
41 | 36 | #define SQUASHFS_DEVBLK_SIZE 4096 |
42 | 37 | |
... | ... | @@ -46,12 +41,12 @@ |
46 | 41 | #define SQUASHFS_FILE_MAX_SIZE 1048576 |
47 | 42 | #define SQUASHFS_FILE_MAX_LOG 20 |
48 | 43 | |
49 | -/* Max number of uids and gids */ | |
50 | -#define SQUASHFS_IDS 65536 | |
51 | - | |
52 | 44 | /* Max length of filename (not 255) */ |
53 | 45 | #define SQUASHFS_NAME_LEN 256 |
54 | 46 | |
47 | +/* Max value for directory header count*/ | |
48 | +#define SQUASHFS_DIR_COUNT 256 | |
49 | + | |
55 | 50 | #define SQUASHFS_INVALID_FRAG (0xffffffffU) |
56 | 51 | #define SQUASHFS_INVALID_XATTR (0xffffffffU) |
57 | 52 | #define SQUASHFS_INVALID_BLK (-1LL) |
... | ... | @@ -142,9 +137,6 @@ |
142 | 137 | #define SQUASHFS_MKINODE(A, B) ((long long)(((long long) (A)\ |
143 | 138 | << 16) + (B))) |
144 | 139 | |
145 | -/* Translate between VFS mode and squashfs mode */ | |
146 | -#define SQUASHFS_MODE(A) ((A) & 0xfff) | |
147 | - | |
148 | 140 | /* fragment and fragment table defines */ |
149 | 141 | #define SQUASHFS_FRAGMENT_BYTES(A) \ |
150 | 142 | ((A) * sizeof(struct squashfs_fragment_entry)) |
... | ... | @@ -214,11 +206,6 @@ |
214 | 206 | |
215 | 207 | /* cached data constants for filesystem */ |
216 | 208 | #define SQUASHFS_CACHED_BLKS 8 |
217 | - | |
218 | -#define SQUASHFS_MAX_FILE_SIZE_LOG 64 | |
219 | - | |
220 | -#define SQUASHFS_MAX_FILE_SIZE (1LL << \ | |
221 | - (SQUASHFS_MAX_FILE_SIZE_LOG - 2)) | |
222 | 209 | |
223 | 210 | /* meta index cache */ |
224 | 211 | #define SQUASHFS_META_INDEXES (SQUASHFS_METADATA_SIZE / sizeof(unsigned int)) |
fs/squashfs/super.c
... | ... | @@ -158,8 +158,13 @@ |
158 | 158 | goto failed_mount; |
159 | 159 | } |
160 | 160 | |
161 | + /* Check block log for sanity */ | |
161 | 162 | msblk->block_log = le16_to_cpu(sblk->block_log); |
162 | 163 | if (msblk->block_log > SQUASHFS_FILE_MAX_LOG) |
164 | + goto failed_mount; | |
165 | + | |
166 | + /* Check that block_size and block_log match */ | |
167 | + if (msblk->block_size != (1 << msblk->block_log)) | |
163 | 168 | goto failed_mount; |
164 | 169 | |
165 | 170 | /* Check the root inode for sanity */ |