[PATCH] squashfs: fix signed overflow in get_dir_index_using_name()

[PATCH] squashfs: fix signed overflow in get_dir_index_using_name()

[Guo Zihao]

The index field of the squashfs_dir_index entries is a u32 taken
from the image and stored in the int length:

length = le32_to_cpu(index->index);

Both later uses of length do signed arithmetic that a crafted image
can overflow:

*next_offset = (length + *next_offset) % SQUASHFS_METADATA_SIZE;
return length + 3;

Keep length unsigned so the additions wrap instead of invoking
undefined behaviour.  The wrapped offset only degrades the lookup:
squashfs_read_metadata() already rejects offsets outside the
metadata block.

Fixes: c88da2c97936 ("Squashfs: directory lookup operations")
Cc: stable@vger.kernel.org
Signed-off-by: Guo Zihao <guozh23@xiaopeng.com>
---
UBSan replica of get_dir_index_using_name(): index = 0x7fffffff reports
"signed integer overflow: 2147483647 + 100 cannot be represented in type
'int'".  QEMU boot with patched and unpatched kernels: a normal image
mounts identically; a crafted image with index = 0x7fffffff returns EIO
from lookup on both kernels (no behavioural change, only the UB removed).

 fs/squashfs/namei.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/fs/squashfs/namei.c b/fs/squashfs/namei.c
index 65aae7e2a..ffc23eef8 100644
--- a/fs/squashfs/namei.c
+++ b/fs/squashfs/namei.c
@@ -65,7 +65,8 @@ static int get_dir_index_using_name(struct super_block *sb,
 			int index_offset, int i_count, const char *name)
 {
 	struct squashfs_sb_info *msblk = sb->s_fs_info;
-	int i, length = 0, err;
+	int i, err;
+	unsigned int length = 0;
 	unsigned int size;
 	struct squashfs_dir_index *index;
 
-- 
2.50.1