[PATCH 3/6] squashfs metadata 2: electric boogaloo

[Ahmad Fatoum]

This is a port of Linux commit cdbb65c4c7ead680ebe54f4f0d486e2847a500ea:

| Author:     Linus Torvalds <torvalds at linux-foundation.org>
| AuthorDate: Wed Aug 1 10:38:43 2018 -0700
|
| Anatoly continues to find issues with fuzzed squashfs images.
|
| This time, corrupt, missing, or undersized data for the page filling
| wasn't checked for, because the squashfs_{copy,read}_cache() functions
| did the squashfs_copy_data() call without checking the resulting data
| size.
|
| Which could result in the page cache pages being incompletely filled in,
| and no error indication to the user space reading garbage data.
|
| So make a helper function for the "fill in pages" case, because the
| exact same incomplete sequence existed in two places.
|
| [ I should have made a squashfs branch for these things, but I didn't
|   intend to start doing them in the first place.
|
|   My historical connection through cramfs is why I got into looking at
|   these issues at all, and every time I (continue to) think it's a
|   one-off.
|
|   Because _this_ time is always the last time. Right?   - Linus ]
|
| Reported-by: Anatoly Trosinenko <anatoly.trosinenko at gmail.com>
| Tested-by: Willy Tarreau <w at 1wt.eu>
| Cc: Al Viro <viro at zeniv.linux.org.uk>
| Cc: Phillip Lougher <phillip at squashfs.org.uk>
| Signed-off-by: Linus Torvalds <torvalds at linux-foundation.org>

Reported-by: Richard Weinberger <richard at sigma-star.at>
Signed-off-by: Ahmad Fatoum <a.fatoum at pengutronix.de>
---
 fs/squashfs/file.c       | 23 +++++++++++++++++++----
 fs/squashfs/file_cache.c |  5 +++--
 fs/squashfs/squashfs.h   |  2 +-
 3 files changed, 23 insertions(+), 7 deletions(-)

diff --git a/fs/squashfs/file.c b/fs/squashfs/file.c
index 1413ef7ecbd8..8316f0edb645 100644
--- a/fs/squashfs/file.c
+++ b/fs/squashfs/file.c
@@ -347,12 +347,23 @@ static int read_blocklist(struct inode *inode, int index, u64 *block)
 	return squashfs_block_size(size);
 }
 
+static int squashfs_fill_page(char *dest, struct squashfs_cache_entry *buffer,
+			      int offset, int avail)
+{
+	int copied;
+
+	copied = squashfs_copy_data(dest, buffer, offset, avail);
+	memset(dest + avail, 0, PAGE_CACHE_SIZE - avail);
+
+	return copied == avail ? 0 : -EILSEQ;
+}
+
 /* Copy data into page cache  */
-void squashfs_copy_cache(struct page *page, struct squashfs_cache_entry *buffer,
+int squashfs_copy_cache(struct page *page, struct squashfs_cache_entry *buffer,
 	int bytes, int offset)
 {
-	int i;
 	struct squashfs_page *sq_page = squashfs_page(page);
+	int ret, i;
 
 	/*
 	 * Loop copying datablock into pages.  As the datablock likely covers
@@ -366,10 +377,14 @@ void squashfs_copy_cache(struct page *page, struct squashfs_cache_entry *buffer,
 
 		TRACE("bytes %d, i %d, available_bytes %d\n", bytes, i, avail);
 
-		squashfs_copy_data(sq_page->buf[i], buffer, offset, avail);
-		memset(sq_page->buf[i] + avail, 0, PAGE_CACHE_SIZE - avail);
+		ret = squashfs_fill_page(sq_page->buf[i], buffer, offset, avail);
+		if (ret)
+			return ret;
+
 		sq_page->idx++;
 	}
+
+	return 0;
 }
 
 /* Read datablock stored packed inside a fragment (tail-end packed block) */
diff --git a/fs/squashfs/file_cache.c b/fs/squashfs/file_cache.c
index 9443e4558d1a..fbd829849d18 100644
--- a/fs/squashfs/file_cache.c
+++ b/fs/squashfs/file_cache.c
@@ -24,11 +24,12 @@ int squashfs_readpage_block(struct page *page, u64 block, int bsize)
 		block, bsize);
 	int res = buffer->error;
 
+	if (!res)
+		res = squashfs_copy_cache(page, buffer, buffer->length, 0);
+
 	if (res)
 		ERROR("Unable to read page, block %llx, size %x\n", block,
 			bsize);
-	else
-		squashfs_copy_cache(page, buffer, buffer->length, 0);
 
 	squashfs_cache_put(buffer);
 	return res;
diff --git a/fs/squashfs/squashfs.h b/fs/squashfs/squashfs.h
index d22e83dc3c55..456021dcfd3e 100644
--- a/fs/squashfs/squashfs.h
+++ b/fs/squashfs/squashfs.h
@@ -93,7 +93,7 @@ extern int squashfs_frag_lookup(struct super_block *, unsigned int, u64 *);
 extern __le64 *squashfs_read_fragment_index_table(struct super_block *,
 				u64, u64, unsigned int);
 /* file.c */
-void squashfs_copy_cache(struct page *, struct squashfs_cache_entry *, int,
+int squashfs_copy_cache(struct page *, struct squashfs_cache_entry *, int,
 				int);
 extern int squashfs_readpage(struct file *file, struct page *page);
 
-- 
2.39.2