From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from sxplsmtpa04-08.prod.sxb1.secureserver.net (sxplsmtpa04-08.prod.sxb1.secureserver.net [188.121.53.83]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 36DFC2EBDFA for ; Wed, 22 Jul 2026 06:35:46 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=188.121.53.83 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784702149; cv=none; b=GiR1tEJGpALuAzcWcslQOQM93cPjN0MFxeRt1g5GlC4JczQcfm1qf9SDnA6Wu56NfQbxSpmjXupXKj2o0WZMbYH6vupaoTxPoZnLY5sqTP6JeOmpn6smyMQdFFQUjaNxdpxGlguzqmmbIJUhKp2Vi6nUVSi6W3WRHkEaOe8FyI8= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784702149; c=relaxed/simple; bh=0UBam068PQr/Ro1DC1huSyMGwoWckILzaabLwQSuBPY=; h=Message-ID:Date:MIME-Version:Subject:To:Cc:References:From: In-Reply-To:Content-Type; b=pabbF9w+PMb+DDKMe80s4D2TCm3xGQHYLvUfgE9cfY6JYSIQzuiZzGWkMLvygXOMlmXX6hUdrx0lkWy8ygBJuq1ew6yCZigz70EciAgBv44pG3oBcf0l+F3kfgwdEppx1x35khNd34xLeNx1D8l/YoOlXaHCBRobYeHCbAKUTbw= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=squashfs.org.uk; spf=pass smtp.mailfrom=squashfs.org.uk; dkim=pass (2048-bit key) header.d=secureserver.net header.i=@secureserver.net header.b=XsiuRXKz; dkim=pass (2048-bit key) header.d=squashfs.org.uk header.i=@squashfs.org.uk header.b=Ho+ztUby; arc=none smtp.client-ip=188.121.53.83 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=squashfs.org.uk Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=squashfs.org.uk Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=secureserver.net header.i=@secureserver.net header.b="XsiuRXKz"; dkim=pass (2048-bit key) header.d=squashfs.org.uk header.i=@squashfs.org.uk header.b="Ho+ztUby" Received: from [192.168.178.95] ([82.69.79.175]) by :SMTPAUTH: with ESMTPSA id mQFuwuvGn4NKQmQFwwuFbA; Wed, 22 Jul 2026 06:16:37 +0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=secureserver.net; s=secureserver2; t=1784700998; bh=x7kxKq5E4Q4/9a5Ba7UDIJbIaxgDB/XZ4aQ8iP9dJmg=; h=Date:Subject:To:Cc:References:From:In-Reply-To; b=XsiuRXKzz+xTLt/w/cUh6XGbWRAM9CMZDgWBMBkd0nriu3MS/QJdLtytelFtjerV3 HSHkK4v1h2ipjDZztPzDQ5gAxYR4MXdj1K35R6MUyprHUyp9SLy+AoyBsvgz9uVv71 X2EeUHMOK5JfpQXVKmM6P7H+Xk7+cMR8Jee+T3h7P8HP62YEZM0Psyz8XU6ziYGBnC XEzcwSH/eZKKvfUhQNM9pEiyPaR8SDgNQTKQTlrGFAvRZU9z8Gdt2NMW8ChPA19BRM vK5NjpHAXd5r3dmhI5LVhRm/Cxsg/EYbbghdqZYLHw8OLwpaOc5E8EeHHiC77szt4Q 8gTtWvJt64nzw== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=squashfs.org.uk; s=secureserver2; t=1784700998; bh=x7kxKq5E4Q4/9a5Ba7UDIJbIaxgDB/XZ4aQ8iP9dJmg=; h=Date:Subject:To:Cc:References:From:In-Reply-To; b=Ho+ztUbyNOPiPIOj59Uqr44EA3jIGysJnmL2STz8dEG143UphPRBmpgKPTX2wRGY/ 0+hcqXhqhltxFGp72puhaZgOrdzuKjnTOzhzCghweOpZJqn4NTeDGyRZYPIj70Hy6x y1N2uPIHaIE2HV88gQKkRtj/bSNZJA+eZRc3y6K6H12R8Qv4yr08si8p1UHsHMU9Bm lXACN33DoWVDOGIwhV/y5GUJiYBDG5NrbZf/8mi2po3/OnQSM+HbmfQKIaIqWJWqZD Hs2FVlcP6ICS/HjcLWZsvY3ARHzGZCJjlJdzC5aGnhG9c5I71/IHrQPiouYQUn/Cnu Au7UwOMZxJivQ== X-CMAE-Analysis: v=2.4 cv=b+EYJNGx c=1 sm=1 tr=0 ts=6a606045 a=84ok6UeoqCVsigPHarzEiQ==:117 a=84ok6UeoqCVsigPHarzEiQ==:17 a=IkcTkHD0fZMA:10 a=FXvPX3liAAAA:8 a=Wq_rEvDOkcdMs_UxPIwA:9 a=QEXdDO2ut3YA:10 a=UObqyxdv-6Yh2QiB9mM_:22 Feedback-ID: 9dc38577976c9eb2ba6139c50e4a5631:squashfs.org.uk:ssnet X-SECURESERVER-ACCT: phillip@squashfs.org.uk Message-ID: <8875193b-e30e-4dc3-8222-714300768cd0@squashfs.org.uk> Date: Wed, 22 Jul 2026 07:21:16 +0100 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: Re: [PATCH v2] squashfs: Add dictionary size range check to prevent shift-out-of-bounds To: Ran Hongyun Cc: linux-kernel@vger.kernel.org, chengzhihao1@huawei.com, yangerkun@huawei.com, yi.zhang@huawei.com, brauner@kernel.org, Andrew Morton References: <20260713115525.2661734-1-ranhongyun1@huawei.com> Content-Language: en-US From: Phillip Lougher In-Reply-To: <20260713115525.2661734-1-ranhongyun1@huawei.com> Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit X-CMAE-Envelope: MS4xfKqq4DVY5GmiPeSA2+lUpvQ1qGRd9xNCTqCUtCen9/4knZlOMgkcOOVsyJiT8dC7u4YCXoOpYiewjKYLjKHKGoV8ZDCjESVZV+cw96VK1m/H0482hPWo 7K+4bSym4aO7vYKsGRQB2N3/J0pDZETn0mecLufLNkKZ92DbFE5mfmPgtq40UX3IN7iNot5+T3HwSEsRaG3k84ejzuyhutOaOKtybG+On9iYirTBHCGn/h8D TtTbRkug7o85Xtbl1mmxWeDDl8+Ta04CRU50YPjslKXpIansVu3ud2rGtwB+pLrxzf5TRaLHTiLnUW2+ZKUk3V8r3S7aaWciQln84sZ6NpLOG5wmoI8qCpQx y3XCSNpOIlNDDb2EtedJHEoF9YG25efxvg/ojzI6OIXvXRyzypU= On 13/07/2026 12:55, Ran Hongyun wrote: > When an abnormal SquashFS image (COMP_OPTS flag is 1 but dictionary size > is 0) is mounted, and performs shift operations using dictionarysize, the > shift exponent is -1, causing a shift-out-of-bounds. > > Detail as below: > squashfs_comp_opts(msblk, buffer, length) > squashfs_xz_comp_opts() > if (comp_opts) > n = ffs(opts->dict_size) - 1;<----opts->dict_size=0, n=-1 > if (opts->dict_size != (1 << n) && opts->dict_size != > (1 << n) + (1 << (n + 1))) <----shift-out-of-bounds > > Fix it by adding a dictionary size range check before the shift operation. Reviewed-by: Phillip Lougher Andrew Morton handles patch submission to Linus for me. CC'ing him. Phillip