From: kernel test robot <lkp@intel.com>
To: Phillip Lougher <phillip@squashfs.org.uk>,
akpm@linux-foundation.org, linux-kernel@vger.kernel.org
Cc: llvm@lists.linux.dev, oe-kbuild-all@lists.linux.dev,
Phillip Lougher <phillip@squashfs.org.uk>
Subject: Re: [PATCH 09/18] Squashfs: sanity check inode metadata block location
Date: Sun, 8 Nov 2026 06:47:54 +0800 [thread overview]
Message-ID: <202611080635.7XPojc0A-lkp@intel.com> (raw)
In-Reply-To: <20261107052843.725239-10-phillip@squashfs.org.uk>
Hi Phillip,
kernel test robot noticed the following build warnings:
[auto build test WARNING on brauner-vfs/vfs.all]
[also build test WARNING on linus/master v7.4-rc1]
[cannot apply to akpm-mm/mm-everything next-20261105]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch#_base_tree_information]
url: https://github.com/intel-lab-lkp/linux/commits/Phillip-Lougher/Squashfs-convert-SQUASHFS_COMPRESSED_-to-inline-functions/20261107-052826
base: https://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs.git vfs.all
patch link: https://lore.kernel.org/r/20261107052843.725239-10-phillip%40squashfs.org.uk
patch subject: [PATCH 09/18] Squashfs: sanity check inode metadata block location
config: loongarch-defconfig (https://download.01.org/0day-ci/archive/20261108/202611080635.7XPojc0A-lkp@intel.com/config)
compiler: clang version 24.0.0git (https://github.com/llvm/llvm-project fc9576e3b179738d99c5babe5cd9d6c1f883e0db)
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20261108/202611080635.7XPojc0A-lkp@intel.com/reproduce)
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202611080635.7XPojc0A-lkp@intel.com/
All warnings (new ones prefixed by >>):
>> fs/squashfs/inode.c:121:6: warning: variable 'err' is used uninitialized whenever 'if' condition is true [-Wsometimes-uninitialized]
121 | if (block < 0)
| ^~~~~~~~~
fs/squashfs/inode.c:454:9: note: uninitialized use occurs here
454 | return err;
| ^~~
fs/squashfs/inode.c:121:2: note: remove the 'if' if its condition is always false
121 | if (block < 0)
| ^~~~~~~~~~~~~~
122 | goto failed_read;
| ~~~~~~~~~~~~~~~~
fs/squashfs/inode.c:114:9: note: initialize the variable 'err' to silence this warning
114 | int err, type;
| ^
| = 0
1 warning generated.
vim +121 fs/squashfs/inode.c
102
103
104 /*
105 * Initialise VFS inode by reading inode from inode table (compressed
106 * metadata). The format and amount of data read depends on type.
107 */
108 int squashfs_read_inode(struct inode *inode, long long ino)
109 {
110 struct super_block *sb = inode->i_sb;
111 struct squashfs_sb_info *msblk = sb->s_fs_info;
112 s64 block = squashfs_inode_start(msblk, ino), sblock = block;
113 int offset = squashfs_inode_offset(ino), soffset = offset;
114 int err, type;
115 union squashfs_inode squashfs_ino;
116 struct squashfs_base_inode *sqshb_ino = &squashfs_ino.base;
117 int xattr_id = SQUASHFS_INVALID_XATTR;
118
119 TRACE("Entered squashfs_read_inode\n");
120
> 121 if (block < 0)
122 goto failed_read;
123 /*
124 * Read inode base common to all inode types.
125 */
126 err = squashfs_read_metadata(sb, sqshb_ino, &sblock,
127 &soffset, sizeof(*sqshb_ino));
128 if (err < 0)
129 goto failed_read;
130
131 err = squashfs_new_inode(sb, inode, sqshb_ino);
132 if (err)
133 goto failed_read;
134
135 type = le16_to_cpu(sqshb_ino->inode_type);
136 switch (type) {
137 case SQUASHFS_REG_TYPE: {
138 unsigned int frag_offset, frag;
139 int frag_size;
140 u64 frag_blk;
141 struct squashfs_reg_inode *sqsh_ino = &squashfs_ino.reg;
142
143 err = squashfs_read_metadata(sb, sqsh_ino, &block, &offset,
144 sizeof(*sqsh_ino));
145 if (err < 0)
146 goto failed_read;
147
148 inode->i_size = le32_to_cpu(sqsh_ino->file_size);
149 frag = le32_to_cpu(sqsh_ino->fragment);
150 if (frag != SQUASHFS_INVALID_FRAG) {
151 /*
152 * the file cannot have a fragment (tailend) and have a
153 * file size a multiple of the block size
154 */
155 if ((inode->i_size & (msblk->block_size - 1)) == 0) {
156 err = -EINVAL;
157 goto failed_read;
158 }
159 frag_offset = le32_to_cpu(sqsh_ino->offset);
160 frag_size = squashfs_frag_lookup(sb, frag, &frag_blk);
161 if (frag_size < 0) {
162 err = frag_size;
163 goto failed_read;
164 }
165 } else {
166 frag_blk = SQUASHFS_INVALID_BLK;
167 frag_size = 0;
168 frag_offset = 0;
169 }
170
171 set_nlink(inode, 1);
172 inode->i_fop = &squashfs_file_operations;
173 inode->i_mode |= S_IFREG;
174 inode->i_blocks = ((inode->i_size - 1) >> 9) + 1;
175 squashfs_i(inode)->fragment_block = frag_blk;
176 squashfs_i(inode)->fragment_size = frag_size;
177 squashfs_i(inode)->fragment_offset = frag_offset;
178 squashfs_i(inode)->start = le32_to_cpu(sqsh_ino->start_block);
179 squashfs_i(inode)->block_list_start = block;
180 squashfs_i(inode)->offset = offset;
181 squashfs_i(inode)->parent = 0;
182 inode->i_data.a_ops = &squashfs_aops;
183
184 TRACE("File inode %x:%x, start_block %llx, block_list_start "
185 "%llx, offset %x\n", squashfs_inode_blk(ino),
186 squashfs_inode_offset(ino), squashfs_i(inode)->start,
187 block, offset);
188 break;
189 }
190 case SQUASHFS_LREG_TYPE: {
191 unsigned int frag_offset, frag;
192 int frag_size;
193 u64 frag_blk;
194 struct squashfs_lreg_inode *sqsh_ino = &squashfs_ino.lreg;
195
196 err = squashfs_read_metadata(sb, sqsh_ino, &block, &offset,
197 sizeof(*sqsh_ino));
198 if (err < 0)
199 goto failed_read;
200
201 inode->i_size = le64_to_cpu(sqsh_ino->file_size);
202 if (inode->i_size < 0) {
203 err = -EINVAL;
204 goto failed_read;
205 }
206 frag = le32_to_cpu(sqsh_ino->fragment);
207 if (frag != SQUASHFS_INVALID_FRAG) {
208 /*
209 * the file cannot have a fragment (tailend) and have a
210 * file size a multiple of the block size
211 */
212 if ((inode->i_size & (msblk->block_size - 1)) == 0) {
213 err = -EINVAL;
214 goto failed_read;
215 }
216 frag_offset = le32_to_cpu(sqsh_ino->offset);
217 frag_size = squashfs_frag_lookup(sb, frag, &frag_blk);
218 if (frag_size < 0) {
219 err = frag_size;
220 goto failed_read;
221 }
222 } else {
223 frag_blk = SQUASHFS_INVALID_BLK;
224 frag_size = 0;
225 frag_offset = 0;
226 }
227
228 xattr_id = le32_to_cpu(sqsh_ino->xattr);
229 set_nlink(inode, le32_to_cpu(sqsh_ino->nlink));
230 inode->i_op = &squashfs_inode_ops;
231 inode->i_fop = &squashfs_file_operations;
232 inode->i_mode |= S_IFREG;
233 inode->i_blocks = (inode->i_size -
234 le64_to_cpu(sqsh_ino->sparse) + 511) >> 9;
235
236 squashfs_i(inode)->fragment_block = frag_blk;
237 squashfs_i(inode)->fragment_size = frag_size;
238 squashfs_i(inode)->fragment_offset = frag_offset;
239 squashfs_i(inode)->start = le64_to_cpu(sqsh_ino->start_block);
240 squashfs_i(inode)->block_list_start = block;
241 squashfs_i(inode)->offset = offset;
242 squashfs_i(inode)->parent = 0;
243 inode->i_data.a_ops = &squashfs_aops;
244
245 TRACE("File inode %x:%x, start_block %llx, block_list_start "
246 "%llx, offset %x\n", squashfs_inode_blk(ino),
247 squashfs_inode_offset(ino), squashfs_i(inode)->start,
248 block, offset);
249 break;
250 }
251 case SQUASHFS_DIR_TYPE: {
252 struct squashfs_dir_inode *sqsh_ino = &squashfs_ino.dir;
253
254 err = squashfs_read_metadata(sb, sqsh_ino, &block, &offset,
255 sizeof(*sqsh_ino));
256 if (err < 0)
257 goto failed_read;
258
259 set_nlink(inode, le32_to_cpu(sqsh_ino->nlink));
260 inode->i_size = le16_to_cpu(sqsh_ino->file_size);
261 inode->i_op = &squashfs_dir_inode_ops;
262 inode->i_fop = &squashfs_dir_ops;
263 inode->i_mode |= S_IFDIR;
264 squashfs_i(inode)->start = le32_to_cpu(sqsh_ino->start_block);
265 squashfs_i(inode)->offset = le16_to_cpu(sqsh_ino->offset);
266 squashfs_i(inode)->dir_idx_cnt = 0;
267 squashfs_i(inode)->parent = le32_to_cpu(sqsh_ino->parent_inode);
268
269 TRACE("Directory inode %x:%x, start_block %llx, offset %x\n",
270 squashfs_inode_blk(ino), squashfs_inode_offset(ino),
271 squashfs_i(inode)->start,
272 le16_to_cpu(sqsh_ino->offset));
273 break;
274 }
275 case SQUASHFS_LDIR_TYPE: {
276 struct squashfs_ldir_inode *sqsh_ino = &squashfs_ino.ldir;
277
278 err = squashfs_read_metadata(sb, sqsh_ino, &block, &offset,
279 sizeof(*sqsh_ino));
280 if (err < 0)
281 goto failed_read;
282
283 xattr_id = le32_to_cpu(sqsh_ino->xattr);
284 set_nlink(inode, le32_to_cpu(sqsh_ino->nlink));
285 inode->i_size = le32_to_cpu(sqsh_ino->file_size);
286 inode->i_op = &squashfs_dir_inode_ops;
287 inode->i_fop = &squashfs_dir_ops;
288 inode->i_mode |= S_IFDIR;
289 squashfs_i(inode)->start = le32_to_cpu(sqsh_ino->start_block);
290 squashfs_i(inode)->offset = le16_to_cpu(sqsh_ino->offset);
291 squashfs_i(inode)->dir_idx_start = block;
292 squashfs_i(inode)->dir_idx_offset = offset;
293 squashfs_i(inode)->dir_idx_cnt = le16_to_cpu(sqsh_ino->i_count);
294 squashfs_i(inode)->parent = le32_to_cpu(sqsh_ino->parent_inode);
295
296 TRACE("Long directory inode %x:%x, start_block %llx, offset "
297 "%x\n", squashfs_inode_blk(ino),
298 squashfs_inode_offset(ino),
299 squashfs_i(inode)->start,
300 le16_to_cpu(sqsh_ino->offset));
301 break;
302 }
303 case SQUASHFS_SYMLINK_TYPE:
304 case SQUASHFS_LSYMLINK_TYPE: {
305 struct squashfs_symlink_inode *sqsh_ino = &squashfs_ino.symlink;
306
307 err = squashfs_read_metadata(sb, sqsh_ino, &block, &offset,
308 sizeof(*sqsh_ino));
309 if (err < 0)
310 goto failed_read;
311
312 inode->i_size = le32_to_cpu(sqsh_ino->symlink_size);
313 if (inode->i_size > PAGE_SIZE) {
314 ERROR("Corrupted symlink\n");
315 return -EINVAL;
316 }
317
318 set_nlink(inode, le32_to_cpu(sqsh_ino->nlink));
319 inode->i_op = &squashfs_symlink_inode_ops;
320 inode_nohighmem(inode);
321 inode->i_data.a_ops = &squashfs_symlink_aops;
322 inode->i_mode |= S_IFLNK;
323 squashfs_i(inode)->start = block;
324 squashfs_i(inode)->offset = offset;
325 squashfs_i(inode)->parent = 0;
326
327 if (type == SQUASHFS_LSYMLINK_TYPE) {
328 __le32 xattr;
329
330 err = squashfs_read_metadata(sb, NULL, &block,
331 &offset, inode->i_size);
332 if (err < 0)
333 goto failed_read;
334 err = squashfs_read_metadata(sb, &xattr, &block,
335 &offset, sizeof(xattr));
336 if (err < 0)
337 goto failed_read;
338 xattr_id = le32_to_cpu(xattr);
339 }
340
341 TRACE("Symbolic link inode %x:%x, start_block %llx, offset "
342 "%x\n", squashfs_inode_blk(ino),
343 squashfs_inode_offset(ino), block, offset);
344 break;
345 }
346 case SQUASHFS_BLKDEV_TYPE:
347 case SQUASHFS_CHRDEV_TYPE: {
348 struct squashfs_dev_inode *sqsh_ino = &squashfs_ino.dev;
349 unsigned int rdev;
350
351 err = squashfs_read_metadata(sb, sqsh_ino, &block, &offset,
352 sizeof(*sqsh_ino));
353 if (err < 0)
354 goto failed_read;
355
356 if (type == SQUASHFS_CHRDEV_TYPE)
357 inode->i_mode |= S_IFCHR;
358 else
359 inode->i_mode |= S_IFBLK;
360 set_nlink(inode, le32_to_cpu(sqsh_ino->nlink));
361 rdev = le32_to_cpu(sqsh_ino->rdev);
362 init_special_inode(inode, inode->i_mode, new_decode_dev(rdev));
363 squashfs_i(inode)->parent = 0;
364
365 TRACE("Device inode %x:%x, rdev %x\n",
366 squashfs_inode_blk(ino),
367 squashfs_inode_offset(ino), rdev);
368 break;
369 }
370 case SQUASHFS_LBLKDEV_TYPE:
371 case SQUASHFS_LCHRDEV_TYPE: {
372 struct squashfs_ldev_inode *sqsh_ino = &squashfs_ino.ldev;
373 unsigned int rdev;
374
375 err = squashfs_read_metadata(sb, sqsh_ino, &block, &offset,
376 sizeof(*sqsh_ino));
377 if (err < 0)
378 goto failed_read;
379
380 if (type == SQUASHFS_LCHRDEV_TYPE)
381 inode->i_mode |= S_IFCHR;
382 else
383 inode->i_mode |= S_IFBLK;
384 xattr_id = le32_to_cpu(sqsh_ino->xattr);
385 inode->i_op = &squashfs_inode_ops;
386 set_nlink(inode, le32_to_cpu(sqsh_ino->nlink));
387 rdev = le32_to_cpu(sqsh_ino->rdev);
388 init_special_inode(inode, inode->i_mode, new_decode_dev(rdev));
389 squashfs_i(inode)->parent = 0;
390
391 TRACE("Device inode %x:%x, rdev %x\n",
392 squashfs_inode_blk(ino), offset, rdev);
393 break;
394 }
395 case SQUASHFS_FIFO_TYPE:
396 case SQUASHFS_SOCKET_TYPE: {
397 struct squashfs_ipc_inode *sqsh_ino = &squashfs_ino.ipc;
398
399 err = squashfs_read_metadata(sb, sqsh_ino, &block, &offset,
400 sizeof(*sqsh_ino));
401 if (err < 0)
402 goto failed_read;
403
404 if (type == SQUASHFS_FIFO_TYPE)
405 inode->i_mode |= S_IFIFO;
406 else
407 inode->i_mode |= S_IFSOCK;
408 set_nlink(inode, le32_to_cpu(sqsh_ino->nlink));
409 init_special_inode(inode, inode->i_mode, 0);
410 squashfs_i(inode)->parent = 0;
411 break;
412 }
413 case SQUASHFS_LFIFO_TYPE:
414 case SQUASHFS_LSOCKET_TYPE: {
415 struct squashfs_lipc_inode *sqsh_ino = &squashfs_ino.lipc;
416
417 err = squashfs_read_metadata(sb, sqsh_ino, &block, &offset,
418 sizeof(*sqsh_ino));
419 if (err < 0)
420 goto failed_read;
421
422 if (type == SQUASHFS_LFIFO_TYPE)
423 inode->i_mode |= S_IFIFO;
424 else
425 inode->i_mode |= S_IFSOCK;
426 xattr_id = le32_to_cpu(sqsh_ino->xattr);
427 inode->i_op = &squashfs_inode_ops;
428 set_nlink(inode, le32_to_cpu(sqsh_ino->nlink));
429 init_special_inode(inode, inode->i_mode, 0);
430 squashfs_i(inode)->parent = 0;
431 break;
432 }
433 default:
434 ERROR("Unknown inode type %d in squashfs_iget!\n", type);
435 return -EINVAL;
436 }
437
438 if (xattr_id != SQUASHFS_INVALID_XATTR && msblk->xattr_id_table) {
439 err = squashfs_xattr_lookup(sb, xattr_id,
440 &squashfs_i(inode)->xattr_count,
441 &squashfs_i(inode)->xattr_size,
442 &squashfs_i(inode)->xattr);
443 if (err < 0)
444 goto failed_read;
445 inode->i_blocks += ((squashfs_i(inode)->xattr_size - 1) >> 9)
446 + 1;
447 } else
448 squashfs_i(inode)->xattr_count = 0;
449
450 return 0;
451
452 failed_read:
453 ERROR("Unable to read inode 0x%llx\n", ino);
454 return err;
455 }
456
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
next prev parent reply other threads:[~2026-11-07 22:48 UTC|newest]
Thread overview: 21+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-11-07 5:28 [PATCH 00/18] Squashfs: fix a lot of AI issues and AI style issues Phillip Lougher
2026-11-07 5:28 ` [PATCH 01/18] Squashfs: convert SQUASHFS_COMPRESSED_* to inline functions Phillip Lougher
2026-11-07 5:28 ` [PATCH 02/18] Squashfs: convert SQUASHFS_INODE_* and SQUASHFS_MKINODE " Phillip Lougher
2026-11-07 5:28 ` [PATCH 03/18] Squashfs: convert SQUASHFS_FRAGMENT_* " Phillip Lougher
2026-11-07 10:05 ` Joe Perches
2026-11-07 5:28 ` [PATCH 04/18] Squashfs: convert SQUASHFS_LOOKUP_* " Phillip Lougher
2026-11-07 5:28 ` [PATCH 05/18] Squashfs: convert SQUASHFS_ID_* " Phillip Lougher
2026-11-07 5:28 ` [PATCH 06/18] Squashfs: convert SQUASHFS_XATTR_* " Phillip Lougher
2026-11-07 5:28 ` [PATCH 07/18] Squashfs: fix fragment bytes overflow on 32-bit architectures Phillip Lougher
2026-11-07 5:28 ` [PATCH 08/18] Squashfs: fix fragment index table length too large exploit Phillip Lougher
2026-11-07 5:28 ` [PATCH 09/18] Squashfs: sanity check inode metadata block location Phillip Lougher
2026-11-07 22:47 ` kernel test robot [this message]
2026-11-07 5:28 ` [PATCH 10/18] Squashfs: sanity check directory " Phillip Lougher
2026-11-07 5:28 ` [PATCH 11/18] Squashfs: widen xattr count variables and add sanity check Phillip Lougher
2026-11-07 5:28 ` [PATCH 12/18] Squashfs: very large files can exceed an int block count Phillip Lougher
2026-11-07 5:28 ` [PATCH 13/18] Squashfs: add more sanity checking to squashfs_block_size() Phillip Lougher
2026-11-07 5:28 ` [PATCH 14/18] Squashfs: sanity check fragment block location and range Phillip Lougher
2026-11-07 5:28 ` [PATCH 15/18] Squashfs: sanity check block list sizes " Phillip Lougher
2026-11-07 5:28 ` [PATCH 16/18] Squashfs: don't store large export table indexes in memory Phillip Lougher
2026-11-07 5:28 ` [PATCH 17/18] Squashfs: don't store large fragment " Phillip Lougher
2026-11-07 5:28 ` [PATCH 18/18] Squashfs: don't store large xattr id " Phillip Lougher
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=202611080635.7XPojc0A-lkp@intel.com \
--to=lkp@intel.com \
--cc=akpm@linux-foundation.org \
--cc=linux-kernel@vger.kernel.org \
--cc=llvm@lists.linux.dev \
--cc=oe-kbuild-all@lists.linux.dev \
--cc=phillip@squashfs.org.uk \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®