06 Aug, 2018

1 commit

  • commit 71755ee5350b63fb1f283de8561cdb61b47f4d1d upstream.

    The squashfs fragment reading code doesn't actually verify that the
    fragment is inside the fragment table. The end result _is_ verified to
    be inside the image when actually reading the fragment data, but before
    that is done, we may end up taking a page fault because the fragment
    table itself might not even exist.

    Another report from Anatoly and his endless squashfs image fuzzing.

    Reported-by: Анатолий Тросиненко
    Acked-by:: Phillip Lougher ,
    Cc: Willy Tarreau
    Signed-off-by: Linus Torvalds
    Signed-off-by: Greg Kroah-Hartman

    Linus Torvalds
     

20 Nov, 2013

2 commits

  • Further generalise the decompressors by adding a page handler
    abstraction. This adds helpers to allow the decompressors
    to access and process the output buffers in an implementation
    independant manner.

    This allows different types of output buffer to be passed
    to the decompressors, with the implementation specific
    aspects handled at decompression time, but without the
    knowledge being held in the decompressor wrapper code.

    This will allow the decompressors to handle Squashfs
    cache buffers, and page cache pages.

    This patch adds the abstraction and an implementation for
    the caches.

    Signed-off-by: Phillip Lougher
    Reviewed-by: Minchan Kim

    Phillip Lougher
     
  • The decompressor interface and code was written from
    the point of view of single-threaded operation. In doing
    so it mixed a lot of single-threaded implementation specific
    aspects into the decompressor code and elsewhere which makes it
    difficult to seamlessly support multiple different decompressor
    implementations.

    This patch does the following:

    1. It removes compressor_options parsing from the decompressor
    init() function. This allows the decompressor init() function
    to be dynamically called to instantiate multiple decompressors,
    without the compressor options needing to be read and parsed each
    time.

    2. It moves threading and all sleeping operations out of the
    decompressors. In doing so, it makes the decompressors
    non-blocking wrappers which only deal with interfacing with
    the decompressor implementation.

    3. It splits decompressor.[ch] into decompressor generic functions
    in decompressor.[ch], and moves the single threaded
    decompressor implementation into decompressor_single.c.

    The result of this patch is Squashfs should now be able to
    support multiple decompressors by adding new decompressor_xxx.c
    files with specialised implementations of the functions in
    decompressor_single.c

    Signed-off-by: Phillip Lougher
    Reviewed-by: Minchan Kim

    Phillip Lougher
     

30 Dec, 2011

1 commit


26 May, 2011

1 commit


18 May, 2010

1 commit


05 Mar, 2010

1 commit


21 Jan, 2010

2 commits


05 Jan, 2009

1 commit