From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-ej1-f45.google.com (mail-ej1-f45.google.com [209.85.218.45]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id BBB993EFFD7 for ; Sat, 22 Aug 2026 14:33:36 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.218.45 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787409219; cv=none; b=KaxS2F4FFiJFufsooeaVVoD43brj+fVNfZOcGzlV3OBd8aKSR/kP7uocdiK1oVcoqJUV/rhl+ClSzulqoBXJ1AbHxCYvfslkDtg5Yj6cToElk1Y5Fs44C1uhFAJqKFSS4gPS3NV2m4oQmncfukOkS5qYKQeoJaqh/df2Gxv8qN0= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787409219; c=relaxed/simple; bh=1QYYX+dMeDVWguBVqVdPZsENj4GiL2hyJu2I8REDjMI=; h=From:To:Cc:Subject:Date:Message-Id:MIME-Version; b=CaMiCkbs2xQSTAONaUA4y8/D62Wj187UewHT43+1Kboib7kO0Accs1AnqN3PRCOhjVvsu+QDdRzQINz1fo8ddV2A3Y1VGxDSbqjEmguNST3OXRyVkwNXvxAYhlARZike3djSrTYeXaaVvqm74qPioOcmhfq59tAzl6ynekWVNuo= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=Mu51+/oH; arc=none smtp.client-ip=209.85.218.45 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="Mu51+/oH" Received: by mail-ej1-f45.google.com with SMTP id a640c23a62f3a-c15b1da6b82so210725266b.1 for ; Sat, 22 Aug 2026 07:33:36 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1787409214; x=1788014014; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=cwRcbP/fNP1CPhzOzRsFPIXRpX22RcpOUMzf+VeQAxs=; b=Mu51+/oHNeLrl8eube1iA53/zlOHHloD9LKKPQKG3QfcfcPLZnOLNp7oRtZINv6/Ga 4lSu/KVUDuQFY3tiToAwFTGVxAVbLQ0H1gvTa9tVkb5qIT3DB7tMCvjEJ9U6EZZENGL4 8RZDW1E535xzb7L3PmKHsZQf/67u9b2+8LDjce6bByLRMHLwpFYsl1JRnHNC9XSPOT2r N1UxY4ZB0joUpphK/ia6uVj35miowD++0GoO3a15kERJNPEarJCA5dqEgZ3lO/TNMLZh rWFZ3SGMy01+HYodxbfyYk1EHd4p7lFlihJpjEj0SxlHbZU2Kt/ppY0XatQrf/RoC0dt LY0w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1787409214; x=1788014014; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=cwRcbP/fNP1CPhzOzRsFPIXRpX22RcpOUMzf+VeQAxs=; b=FLrHn23VerC3yfr9xXsP3mGgX0KYqdZL/dxS7J60SlUF3AYJ7yk8ZEof+vWHOEDfTQ SNAY3rVjUTMul6+xqStK/9MQqqpT6aVlIPamOEDQHp7fny+0C3r5BF7ZvXiyF27WuU98 MtXtNxVlUbV2/tCVBPVdookWc1oD/Z8IkO+1yPY3jmX64ZzzsC3HC/hKeK+EbFLKbnzK ZZu0RJzQFUjF2aCYmFgM++A+9n1lS95xb3HxAV2prnB3kJK80CYASEaCeuBSQYWdLh6H G6S7mOZFHov0KA6ebJOkKDzRZLoQ1FCT+BL4USW2BOkzKxYRU5t5Zq53P8c4CNF7llQi OS9A== X-Forwarded-Encrypted: i=1; AHgh+RpqFUsGm9quJzhCUyujvdCohstG5OI6ri4dtv/oJYHQMAgabbxXxNVDqBwiS4V/89kZOkX8WVjB5lpdS1E=@vger.kernel.org X-Gm-Message-State: AFuF++kxvYEW/GY4hWaR/HXOkx5q04gkDhJrig/Kf2RR6o0LDkTUuaPO UvLyNJcKSLaIfa2pIK8fvkR2Vkn3k4niNNulWx6ScZpkfcrzldyFUT/1 X-Gm-Gg: AR+sD13ABy3a6hnCc2lyGsrEK3+f9yRD2wAEFenBPt54BfGJkZ32dgSkthG1/m5oz7C LF3pyabBk5v8iCsXlTbWrDIM985HyP6j/zsmwtXHEK6PXoFtRgAZxo85b6a4OhKW3jPJAV9yYho hdt7yfdpslzHf/fkHKVSEFm5WbJeQvxncqlvx6T+4/lYSEIFWCjYG0m7OYC5kC3mn2mWEEZlNBC C+tNhYiHJABaYdGvT0EGSWAUZzPnG9iQ7uKlEeuzNmn3A/+3bC0Y5SJqpmZIZIRMCiAL8rMDjm9 mEHpQNH/Rb1t4bELKkkLOUEuRHjQVE7IDZAZY3O35wZhazQnoZGmVklUBXkX7Q1o26AVEUm9ERY yfgpJlhwTYumtk28t3TElzve6lppmvVi6stJumIilNTXB33bReSvY/eqQfQcJMSjBKdSXTC2S+U R15b4B68TyMkcgvftjKM2+Iq0MqKZIrO7N3CScpfaKgGb4T0hY5AojgqMt+acUzXOjxI6Kojib2 JFXjCpWUXcceVAu+PB83C0xWTsqQvKhD5pxr6v2BagW+rhgVhe4Z3MixoYbcNnd5rHQ81H9SaW1 GQSJ40onOzg1LazSfYdHXUdsHsTTuqJEeh697xAKQsbaBVBGTCPm40+gkCjrQ8xKopnZ X-Received: by 2002:a17:907:a4a:b0:c20:3733:a8c5 with SMTP id a640c23a62f3a-c246a36f311mr1274423366b.8.1787409214359; Sat, 22 Aug 2026 07:33:34 -0700 (PDT) Received: from localhost.localdomain (dynamic-2a02-3100-a0f5-8c01-3de3-cd62-aa6f-2fb0.310.pool.telefonica.de. [2a02:3100:a0f5:8c01:3de3:cd62:aa6f:2fb0]) by smtp.gmail.com with ESMTPSA id a640c23a62f3a-c24967459aesm326597666b.48.2026.08.22.07.33.33 (version=TLS1_3 cipher=TLS_CHACHA20_POLY1305_SHA256 bits=256/256); Sat, 22 Aug 2026 07:33:33 -0700 (PDT) From: Karl Mehltretter To: Phillip Lougher Cc: Karl Mehltretter , Andrew Morton , linux-fsdevel@vger.kernel.org, linux-kernel@vger.kernel.org Subject: [PATCH 0/2] squashfs: harden fragment index table sizing Date: Sat, 22 Aug 2026 16:33:26 +0200 Message-Id: <20260822143328.68867-1-kmehltretter@gmail.com> X-Mailer: git-send-email 2.39.5 (Apple Git-154) Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Two integer overflows undermine fragment index table handling. One is in the original fragment sizing macros. The other is in a bounds check added by commit 1cac63cc9b2f ("Squashfs: add sanity checks to fragment reading at mount time"). Patch 1: the fragment byte count wraps on 32-bit, so the index table is allocated too small and squashfs_frag_lookup() reads out of bounds. A crafted image triggers a KASAN out-of-bounds read on a 32-bit build. With the fix the same image fails cleanly at mount. Patch 2: the check that the table fits before the next one adds two u64 values controlled by the filesystem image and can wrap. Built W=1 with gcc (x86_64, i386) and clang (x86_64). Strict checkpatch is clean. Karl Mehltretter (2): squashfs: fix fragment index table sizing overflow on 32-bit squashfs: make the fragment index table bounds check overflow-safe fs/squashfs/fragment.c | 6 ++++-- fs/squashfs/squashfs_fs.h | 2 +- 2 files changed, 5 insertions(+), 3 deletions(-) -- 2.53.0