12 files changed, 128 insertions, 37 deletions

diff --git a/fs/squashfs/Kconfig b/fs/squashfs/Kconfig
index aa68a8a31518..efc309fa3035 100644
--- a/fs/squashfs/Kconfig
+++ b/fs/squashfs/Kconfig
@@ -5,12 +5,12 @@ config SQUASHFS
         help
           Saying Y here includes support for SquashFS 4.0 (a Compressed
           Read-Only File System).  Squashfs is a highly compressed read-only
-          filesystem for Linux.  It uses zlib/lzo compression to compress both
-          files, inodes and directories.  Inodes in the system are very small
-          and all blocks are packed to minimise data overhead. Block sizes
-          greater than 4K are supported up to a maximum of 1 Mbytes (default
-          block size 128K).  SquashFS 4.0 supports 64 bit filesystems and files
-          (larger than 4GB), full uid/gid information, hard links and
+          filesystem for Linux.  It uses zlib, lzo or xz compression to
+          compress both files, inodes and directories.  Inodes in the system
+          are very small and all blocks are packed to minimise data overhead.
+          Block sizes greater than 4K are supported up to a maximum of 1 Mbytes
+          (default block size 128K).  SquashFS 4.0 supports 64 bit filesystems
+          and files (larger than 4GB), full uid/gid information, hard links and
           timestamps.
 
           Squashfs is intended for general read-only filesystem use, for
diff --git a/fs/squashfs/cache.c b/fs/squashfs/cache.c
index 26b15ae34d6f..c37b520132ff 100644
--- a/fs/squashfs/cache.c
+++ b/fs/squashfs/cache.c
@@ -104,7 +104,7 @@ struct squashfs_cache_entry *squashfs_cache_get(struct super_block *sb,
                         entry = &cache->entry[i];
 
                         /*
-                         * Initialise choosen cache entry, and fill it in from
+                         * Initialise chosen cache entry, and fill it in from
                          * disk.
                          */
                         cache->unused--;
@@ -286,7 +286,7 @@ cleanup:
 
 
 /*
- * Copy upto length bytes from cache entry to buffer starting at offset bytes
+ * Copy up to length bytes from cache entry to buffer starting at offset bytes
  * into the cache entry.  If there's not length bytes then copy the number of
  * bytes available.  In all cases return the number of bytes copied.
  */
diff --git a/fs/squashfs/decompressor.c b/fs/squashfs/decompressor.c
index a5940e54c4dd..e921bd213738 100644
--- a/fs/squashfs/decompressor.c
+++ b/fs/squashfs/decompressor.c
@@ -23,6 +23,7 @@
 
 #include <linux/types.h>
 #include <linux/mutex.h>
+#include <linux/slab.h>
 #include <linux/buffer_head.h>
 
 #include "squashfs_fs.h"
@@ -74,3 +75,36 @@ const struct squashfs_decompressor *squashfs_lookup_decompressor(int id)
 
         return decompressor[i];
 }
+
+
+void *squashfs_decompressor_init(struct super_block *sb, unsigned short flags)
+{
+        struct squashfs_sb_info *msblk = sb->s_fs_info;
+        void *strm, *buffer = NULL;
+        int length = 0;
+
+        /*
+         * Read decompressor specific options from file system if present
+         */
+        if (SQUASHFS_COMP_OPTS(flags)) {
+                buffer = kmalloc(PAGE_CACHE_SIZE, GFP_KERNEL);
+                if (buffer == NULL)
+                        return ERR_PTR(-ENOMEM);
+
+                length = squashfs_read_data(sb, &buffer,
+                        sizeof(struct squashfs_super_block), 0, NULL,
+                        PAGE_CACHE_SIZE, 1);
+
+                if (length < 0) {
+                        strm = ERR_PTR(length);
+                        goto finished;
+                }
+        }
+
+        strm = msblk->decompressor->init(msblk, buffer, length);
+
+finished:
+        kfree(buffer);
+
+        return strm;
+}
diff --git a/fs/squashfs/decompressor.h b/fs/squashfs/decompressor.h
index 3b305a70f7aa..099745ad5691 100644
--- a/fs/squashfs/decompressor.h
+++ b/fs/squashfs/decompressor.h
@@ -24,7 +24,7 @@
  */
 
 struct squashfs_decompressor {
-        void    *(*init)(struct squashfs_sb_info *);
+        void    *(*init)(struct squashfs_sb_info *, void *, int);
         void    (*free)(void *);
         int     (*decompress)(struct squashfs_sb_info *, void **,
                 struct buffer_head **, int, int, int, int, int);
@@ -33,11 +33,6 @@ struct squashfs_decompressor {
         int     supported;
 };
 
-static inline void *squashfs_decompressor_init(struct squashfs_sb_info *msblk)
-{
-        return msblk->decompressor->init(msblk);
-}
-
 static inline void squashfs_decompressor_free(struct squashfs_sb_info *msblk,
         void *s)
 {
diff --git a/fs/squashfs/dir.c b/fs/squashfs/dir.c
index 0dc340aa2be9..3f79cd1d0c19 100644
--- a/fs/squashfs/dir.c
+++ b/fs/squashfs/dir.c
@@ -172,6 +172,11 @@ static int squashfs_readdir(struct file *file, void *dirent, filldir_t filldir)
                 length += sizeof(dirh);
 
                 dir_count = le32_to_cpu(dirh.count) + 1;
+
+                /* dir_count should never be larger than 256 */
+                if (dir_count > 256)
+                        goto failed_read;
+
                 while (dir_count--) {
                         /*
                          * Read directory entry.
@@ -183,6 +188,10 @@ static int squashfs_readdir(struct file *file, void *dirent, filldir_t filldir)
 
                         size = le16_to_cpu(dire->size) + 1;
 
+                        /* size should never be larger than SQUASHFS_NAME_LEN */
+                        if (size > SQUASHFS_NAME_LEN)
+                                goto failed_read;
+
                         err = squashfs_read_metadata(inode->i_sb, dire->name,
                                         &block, &offset, size);
                         if (err < 0)
diff --git a/fs/squashfs/lzo_wrapper.c b/fs/squashfs/lzo_wrapper.c
index 7da759e34c52..00f4dfc5f088 100644
--- a/fs/squashfs/lzo_wrapper.c
+++ b/fs/squashfs/lzo_wrapper.c
@@ -37,7 +37,7 @@ struct squashfs_lzo {
         void    *output;
 };
 
-static void *lzo_init(struct squashfs_sb_info *msblk)
+static void *lzo_init(struct squashfs_sb_info *msblk, void *buff, int len)
 {
         int block_size = max_t(int, msblk->block_size, SQUASHFS_METADATA_SIZE);
 
@@ -58,7 +58,7 @@ failed2:
 failed:
         ERROR("Failed to allocate lzo workspace\n");
         kfree(stream);
-        return NULL;
+        return ERR_PTR(-ENOMEM);
 }
 
 
diff --git a/fs/squashfs/namei.c b/fs/squashfs/namei.c
index 7a9464d08cf6..5d922a6701ab 100644
--- a/fs/squashfs/namei.c
+++ b/fs/squashfs/namei.c
@@ -176,6 +176,11 @@ static struct dentry *squashfs_lookup(struct inode *dir, struct dentry *dentry,
                 length += sizeof(dirh);
 
                 dir_count = le32_to_cpu(dirh.count) + 1;
+
+                /* dir_count should never be larger than 256 */
+                if (dir_count > 256)
+                        goto data_error;
+
                 while (dir_count--) {
                         /*
                          * Read directory entry.
@@ -187,6 +192,10 @@ static struct dentry *squashfs_lookup(struct inode *dir, struct dentry *dentry,
 
                         size = le16_to_cpu(dire->size) + 1;
 
+                        /* size should never be larger than SQUASHFS_NAME_LEN */
+                        if (size > SQUASHFS_NAME_LEN)
+                                goto data_error;
+
                         err = squashfs_read_metadata(dir->i_sb, dire->name,
                                         &block, &offset, size);
                         if (err < 0)
@@ -228,6 +237,9 @@ exit_lookup:
         d_add(dentry, inode);
         return ERR_PTR(0);
 
+data_error:
+        err = -EIO;
+
 read_failure:
         ERROR("Unable to read directory block [%llx:%x]\n",
                 squashfs_i(dir)->start + msblk->directory_table,
diff --git a/fs/squashfs/squashfs.h b/fs/squashfs/squashfs.h
index ba729d808876..1f2e608b8785 100644
--- a/fs/squashfs/squashfs.h
+++ b/fs/squashfs/squashfs.h
@@ -48,6 +48,7 @@ extern int squashfs_read_table(struct super_block *, void *, u64, int);
 
 /* decompressor.c */
 extern const struct squashfs_decompressor *squashfs_lookup_decompressor(int);
+extern void *squashfs_decompressor_init(struct super_block *, unsigned short);
 
 /* export.c */
 extern __le64 *squashfs_read_inode_lookup_table(struct super_block *, u64,
diff --git a/fs/squashfs/squashfs_fs.h b/fs/squashfs/squashfs_fs.h
index 39533feffd6d..4582c568ef4d 100644
--- a/fs/squashfs/squashfs_fs.h
+++ b/fs/squashfs/squashfs_fs.h
@@ -57,6 +57,7 @@
 #define SQUASHFS_ALWAYS_FRAG            5
 #define SQUASHFS_DUPLICATE              6
 #define SQUASHFS_EXPORT                 7
+#define SQUASHFS_COMP_OPT               10
 
 #define SQUASHFS_BIT(flag, bit)         ((flag >> bit) & 1)
 
@@ -81,6 +82,9 @@
 #define SQUASHFS_EXPORTABLE(flags)              SQUASHFS_BIT(flags, \
                                                 SQUASHFS_EXPORT)
 
+#define SQUASHFS_COMP_OPTS(flags)               SQUASHFS_BIT(flags, \
+                                                SQUASHFS_COMP_OPT)
+
 /* Max number of types and file types */
 #define SQUASHFS_DIR_TYPE               1
 #define SQUASHFS_REG_TYPE               2
diff --git a/fs/squashfs/super.c b/fs/squashfs/super.c
index 20700b9f2b4c..5c8184c061a4 100644
--- a/fs/squashfs/super.c
+++ b/fs/squashfs/super.c
@@ -199,10 +199,6 @@ static int squashfs_fill_super(struct super_block *sb, void *data, int silent)
 
         err = -ENOMEM;
 
-        msblk->stream = squashfs_decompressor_init(msblk);
-        if (msblk->stream == NULL)
-                goto failed_mount;
-
         msblk->block_cache = squashfs_cache_init("metadata",
                         SQUASHFS_CACHED_BLKS, SQUASHFS_METADATA_SIZE);
         if (msblk->block_cache == NULL)
@@ -215,6 +211,13 @@ static int squashfs_fill_super(struct super_block *sb, void *data, int silent)
                 goto failed_mount;
         }
 
+        msblk->stream = squashfs_decompressor_init(sb, flags);
+        if (IS_ERR(msblk->stream)) {
+                err = PTR_ERR(msblk->stream);
+                msblk->stream = NULL;
+                goto failed_mount;
+        }
+
         /* Allocate and read id index table */
         msblk->id_table = squashfs_read_id_index_table(sb,
                 le64_to_cpu(sblk->id_table_start), le16_to_cpu(sblk->no_ids));
@@ -370,8 +373,8 @@ static void squashfs_put_super(struct super_block *sb)
 }
 
 
-static struct dentry *squashfs_mount(struct file_system_type *fs_type, int flags,
-                                const char *dev_name, void *data)
+static struct dentry *squashfs_mount(struct file_system_type *fs_type,
+                                int flags, const char *dev_name, void *data)
 {
         return mount_bdev(fs_type, flags, dev_name, data, squashfs_fill_super);
 }
diff --git a/fs/squashfs/xz_wrapper.c b/fs/squashfs/xz_wrapper.c
index c4eb40018256..aa47a286d1f8 100644
--- a/fs/squashfs/xz_wrapper.c
+++ b/fs/squashfs/xz_wrapper.c
@@ -26,10 +26,10 @@
 #include <linux/buffer_head.h>
 #include <linux/slab.h>
 #include <linux/xz.h>
+#include <linux/bitops.h>
 
 #include "squashfs_fs.h"
 #include "squashfs_fs_sb.h"
-#include "squashfs_fs_i.h"
 #include "squashfs.h"
 #include "decompressor.h"
 
@@ -38,24 +38,57 @@ struct squashfs_xz {
         struct xz_buf buf;
 };
 
-static void *squashfs_xz_init(struct squashfs_sb_info *msblk)
+struct comp_opts {
+        __le32 dictionary_size;
+        __le32 flags;
+};
+
+static void *squashfs_xz_init(struct squashfs_sb_info *msblk, void *buff,
+        int len)
 {
-        int block_size = max_t(int, msblk->block_size, SQUASHFS_METADATA_SIZE);
+        struct comp_opts *comp_opts = buff;
+        struct squashfs_xz *stream;
+        int dict_size = msblk->block_size;
+        int err, n;
+
+        if (comp_opts) {
+                /* check compressor options are the expected length */
+                if (len < sizeof(*comp_opts)) {
+                        err = -EIO;
+                        goto failed;
+                }
 
-        struct squashfs_xz *stream = kmalloc(sizeof(*stream), GFP_KERNEL);
-        if (stream == NULL)
+                dict_size = le32_to_cpu(comp_opts->dictionary_size);
+
+                /* the dictionary size should be 2^n or 2^n+2^(n+1) */
+                n = ffs(dict_size) - 1;
+                if (dict_size != (1 << n) && dict_size != (1 << n) +
+                                                (1 << (n + 1))) {
+                        err = -EIO;
+                        goto failed;
+                }
+        }
+
+        dict_size = max_t(int, dict_size, SQUASHFS_METADATA_SIZE);
+
+        stream = kmalloc(sizeof(*stream), GFP_KERNEL);
+        if (stream == NULL) {
+                err = -ENOMEM;
                 goto failed;
+        }
 
-        stream->state = xz_dec_init(XZ_PREALLOC, block_size);
-        if (stream->state == NULL)
+        stream->state = xz_dec_init(XZ_PREALLOC, dict_size);
+        if (stream->state == NULL) {
+                kfree(stream);
+                err = -ENOMEM;
                 goto failed;
+        }
 
         return stream;
 
 failed:
-        ERROR("Failed to allocate xz workspace\n");
-        kfree(stream);
-        return NULL;
+        ERROR("Failed to initialise xz decompressor\n");
+        return ERR_PTR(err);
 }
 
 
diff --git a/fs/squashfs/zlib_wrapper.c b/fs/squashfs/zlib_wrapper.c
index 4661ae2b1cec..517688b32ffa 100644
--- a/fs/squashfs/zlib_wrapper.c
+++ b/fs/squashfs/zlib_wrapper.c
@@ -26,19 +26,19 @@
 #include <linux/buffer_head.h>
 #include <linux/slab.h>
 #include <linux/zlib.h>
+#include <linux/vmalloc.h>
 
 #include "squashfs_fs.h"
 #include "squashfs_fs_sb.h"
 #include "squashfs.h"
 #include "decompressor.h"
 
-static void *zlib_init(struct squashfs_sb_info *dummy)
+static void *zlib_init(struct squashfs_sb_info *dummy, void *buff, int len)
 {
         z_stream *stream = kmalloc(sizeof(z_stream), GFP_KERNEL);
         if (stream == NULL)
                 goto failed;
-        stream->workspace = kmalloc(zlib_inflate_workspacesize(),
-                GFP_KERNEL);
+        stream->workspace = vmalloc(zlib_inflate_workspacesize());
         if (stream->workspace == NULL)
                 goto failed;
 
@@ -47,7 +47,7 @@ static void *zlib_init(struct squashfs_sb_info *dummy)
 failed:
         ERROR("Failed to allocate zlib workspace\n");
         kfree(stream);
-        return NULL;
+        return ERR_PTR(-ENOMEM);
 }
 
 
@@ -56,7 +56,7 @@ static void zlib_free(void *strm)
         z_stream *stream = strm;
 
         if (stream)
-                kfree(stream->workspace);
+                vfree(stream->workspace);
         kfree(stream);
 }