[PATCH] squashfs: add sanity check for invalid inode size

[PATCH] squashfs: add sanity check for invalid inode size

[Sang-Heon Jeon]

Corrupted squashfs images can have negative inode sizes. Add sanity
check to prevent negative inode size.

Reported-by: syzbot+f754e01116421e9754b9@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=f754e01116421e9754b9
Signed-off-by: Sang-Heon Jeon <ekffu200098@gmail.com>
Tested-by: syzbot+f754e01116421e9754b9@syzkaller.appspotmail.com
Cc: Amir Goldstein <amir73il@gmail.com>
---
Special thanks to Amir's kindness analysis [1]. I couldn't find proper
tag for credit, so i just cc-ing. But feel free to add proper credit.

Also, I referred method of erofs. but i might be wrong, please let me
know about that. Thanks for consideration.

[1] https://lore.kernel.org/all/CAOQ4uxgkpi4v3NTSTq5GGJEceHHi97iY4rtsAJuo5c-yxu-Bzg@mail.gmail.com/
---
 fs/squashfs/inode.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/fs/squashfs/inode.c b/fs/squashfs/inode.c
index ddc65d006063..148cd75f5bd7 100644
--- a/fs/squashfs/inode.c
+++ b/fs/squashfs/inode.c
@@ -426,6 +426,12 @@ int squashfs_read_inode(struct inode *inode, long long ino)
 		return -EINVAL;
 	}
 
+	if (unlikely(inode->i_size < 0)) {
+		ERROR("Negative i_size %lld inode 0x%llx\n",
+			inode->i_size, ino);
+		return -EINVAL;
+	}
+
 	if (xattr_id != SQUASHFS_INVALID_XATTR && msblk->xattr_id_table) {
 		err = squashfs_xattr_lookup(sb, xattr_id,
 					&squashfs_i(inode)->xattr_count,
-- 
2.43.0