aboutsummaryrefslogtreecommitdiffstats
path: root/fs/squashfs/super.c
diff options
context:
space:
mode:
authorPhillip Lougher <phillip@lougher.demon.co.uk>2011-05-23 23:33:34 -0400
committerPhillip Lougher <phillip@lougher.demon.co.uk>2011-05-25 13:21:33 -0400
commit1cac63cc9b2ff0d16ab2d16232b1a6ee8676a47b (patch)
tree31ee36dac4a1b351c153058ffa0799a959ba0272 /fs/squashfs/super.c
parentac51a0a7139aa93bf1176b701c86fa3d2bdf6106 (diff)
Squashfs: add sanity checks to fragment reading at mount time
Fsfuzzer generates corrupted filesystems which throw a warn_on in kmalloc. One of these is due to a corrupted superblock fragments field. Fix this by checking that the number of bytes to be read (and allocated) does not extend into the next filesystem structure. Also add a couple of other sanity checks of the mount-time fragment table structures. Signed-off-by: Phillip Lougher <phillip@lougher.demon.co.uk>
Diffstat (limited to 'fs/squashfs/super.c')
-rw-r--r--fs/squashfs/super.c3
1 files changed, 2 insertions, 1 deletions
diff --git a/fs/squashfs/super.c b/fs/squashfs/super.c
index 80a7119870a6..efa8118260d4 100644
--- a/fs/squashfs/super.c
+++ b/fs/squashfs/super.c
@@ -261,6 +261,7 @@ allocate_id_index_table:
261 msblk->inode_lookup_table = NULL; 261 msblk->inode_lookup_table = NULL;
262 goto failed_mount; 262 goto failed_mount;
263 } 263 }
264 next_table = msblk->inode_lookup_table[0];
264 265
265 sb->s_export_op = &squashfs_export_ops; 266 sb->s_export_op = &squashfs_export_ops;
266 267
@@ -278,7 +279,7 @@ handle_fragments:
278 279
279 /* Allocate and read fragment index table */ 280 /* Allocate and read fragment index table */
280 msblk->fragment_index = squashfs_read_fragment_index_table(sb, 281 msblk->fragment_index = squashfs_read_fragment_index_table(sb,
281 le64_to_cpu(sblk->fragment_table_start), fragments); 282 le64_to_cpu(sblk->fragment_table_start), next_table, fragments);
282 if (IS_ERR(msblk->fragment_index)) { 283 if (IS_ERR(msblk->fragment_index)) {
283 ERROR("unable to read fragment index table\n"); 284 ERROR("unable to read fragment index table\n");
284 err = PTR_ERR(msblk->fragment_index); 285 err = PTR_ERR(msblk->fragment_index);