[PATCH 4/6] squashfs: more metadata hardening

[Ahmad Fatoum]

This is a port of Linux commit 71755ee5350b63fb1f283de8561cdb61b47f4d1d:

| Author:     Linus Torvalds <torvalds at linux-foundation.org>
| AuthorDate: Thu Aug 2 08:43:35 2018 -0700
|
| The squashfs fragment reading code doesn't actually verify that the
| fragment is inside the fragment table.  The end result _is_ verified to
| be inside the image when actually reading the fragment data, but before
| that is done, we may end up taking a page fault because the fragment
| table itself might not even exist.
|
| Another report from Anatoly and his endless squashfs image fuzzing.
|
| Reported-by: Анатолий Тросиненко <anatoly.trosinenko at gmail.com>
| Acked-by:: Phillip Lougher <phillip.lougher at gmail.com>,
| Cc: Willy Tarreau <w at 1wt.eu>
| Signed-off-by: Linus Torvalds <torvalds at linux-foundation.org>

Reported-by: Richard Weinberger <richard at sigma-star.at>
Signed-off-by: Ahmad Fatoum <a.fatoum at pengutronix.de>
---
 fs/squashfs/fragment.c       | 13 +++++++++----
 fs/squashfs/squashfs_fs_sb.h |  1 +
 fs/squashfs/super.c          |  5 +++--
 3 files changed, 13 insertions(+), 6 deletions(-)

diff --git a/fs/squashfs/fragment.c b/fs/squashfs/fragment.c
index 343444000e02..9d60741ce5f0 100644
--- a/fs/squashfs/fragment.c
+++ b/fs/squashfs/fragment.c
@@ -44,11 +44,16 @@ int squashfs_frag_lookup(struct super_block *sb, unsigned int fragment,
 				u64 *fragment_block)
 {
 	struct squashfs_sb_info *msblk = sb->s_fs_info;
-	int block = SQUASHFS_FRAGMENT_INDEX(fragment);
-	int offset = SQUASHFS_FRAGMENT_INDEX_OFFSET(fragment);
-	u64 start_block = le64_to_cpu(msblk->fragment_index[block]);
+	int block, offset, size;
 	struct squashfs_fragment_entry fragment_entry;
-	int size;
+	u64 start_block;
+
+	if (fragment >= msblk->fragments)
+		return -EIO;
+	block = SQUASHFS_FRAGMENT_INDEX(fragment);
+	offset = SQUASHFS_FRAGMENT_INDEX_OFFSET(fragment);
+
+	start_block = le64_to_cpu(msblk->fragment_index[block]);
 
 	size = squashfs_read_metadata(sb, &fragment_entry, &start_block,
 					&offset, sizeof(fragment_entry));
diff --git a/fs/squashfs/squashfs_fs_sb.h b/fs/squashfs/squashfs_fs_sb.h
index c6fc37d48f25..8ac5a1f3b6e3 100644
--- a/fs/squashfs/squashfs_fs_sb.h
+++ b/fs/squashfs/squashfs_fs_sb.h
@@ -75,6 +75,7 @@ struct squashfs_sb_info {
 	unsigned short				block_log;
 	long long				bytes_used;
 	unsigned int				inodes;
+	unsigned int				fragments;
 	int					xattr_ids;
 	struct cdev				*cdev;
 	struct device				*dev;
diff --git a/fs/squashfs/super.c b/fs/squashfs/super.c
index 2e34c0e540df..f3dac6de1527 100644
--- a/fs/squashfs/super.c
+++ b/fs/squashfs/super.c
@@ -189,6 +189,7 @@ static int squashfs_fill_super(struct super_block *sb, void *data, int silent)
 	msblk->inode_table = le64_to_cpu(sblk->inode_table_start);
 	msblk->directory_table = le64_to_cpu(sblk->directory_table_start);
 	msblk->inodes = le32_to_cpu(sblk->inodes);
+	msblk->fragments = le32_to_cpu(sblk->fragments);
 	flags = le16_to_cpu(sblk->flags);
 
 	TRACE("Found valid superblock on %pg\n", sb->s_bdev);
@@ -199,7 +200,7 @@ static int squashfs_fill_super(struct super_block *sb, void *data, int silent)
 	TRACE("Filesystem size %lld bytes\n", msblk->bytes_used);
 	TRACE("Block size %d\n", msblk->block_size);
 	TRACE("Number of inodes %d\n", msblk->inodes);
-	TRACE("Number of fragments %d\n", le32_to_cpu(sblk->fragments));
+	TRACE("Number of fragments %d\n", msblk->fragments);
 	TRACE("Number of ids %d\n", le16_to_cpu(sblk->no_ids));
 	TRACE("sblk->inode_table_start %llx\n", msblk->inode_table);
 	TRACE("sblk->directory_table_start %llx\n", msblk->directory_table);
@@ -253,7 +254,7 @@ static int squashfs_fill_super(struct super_block *sb, void *data, int silent)
 		goto handle_fragments;
 
 handle_fragments:
-	fragments = le32_to_cpu(sblk->fragments);
+	fragments = msblk->fragments;
 	if (fragments == 0)
 		goto check_directory_table;
 	msblk->fragment_cache = squashfs_cache_init("fragment",
-- 
2.39.2