aboutsummaryrefslogtreecommitdiffstats
path: root/fs/squashfs/super.c
diff options
context:
space:
mode:
authorPhillip Lougher <phillip@lougher.demon.co.uk>2011-05-24 04:33:34 +0100
committerPhillip Lougher <phillip@lougher.demon.co.uk>2011-05-25 18:21:33 +0100
commit1cac63cc9b2ff0d16ab2d16232b1a6ee8676a47b (patch)
tree31ee36dac4a1b351c153058ffa0799a959ba0272 /fs/squashfs/super.c
parentac51a0a7139aa93bf1176b701c86fa3d2bdf6106 (diff)
Squashfs: add sanity checks to fragment reading at mount time
Fsfuzzer generates corrupted filesystems which throw a warn_on in kmalloc. One of these is due to a corrupted superblock fragments field. Fix this by checking that the number of bytes to be read (and allocated) does not extend into the next filesystem structure. Also add a couple of other sanity checks of the mount-time fragment table structures. Signed-off-by: Phillip Lougher <phillip@lougher.demon.co.uk>
Diffstat (limited to 'fs/squashfs/super.c')
-rw-r--r--fs/squashfs/super.c3
1 files changed, 2 insertions, 1 deletions
diff --git a/fs/squashfs/super.c b/fs/squashfs/super.c
index 80a7119870a..efa8118260d 100644
--- a/fs/squashfs/super.c
+++ b/fs/squashfs/super.c
@@ -261,6 +261,7 @@ allocate_id_index_table:
msblk->inode_lookup_table = NULL;
goto failed_mount;
}
+ next_table = msblk->inode_lookup_table[0];
sb->s_export_op = &squashfs_export_ops;
@@ -278,7 +279,7 @@ handle_fragments:
/* Allocate and read fragment index table */
msblk->fragment_index = squashfs_read_fragment_index_table(sb,
- le64_to_cpu(sblk->fragment_table_start), fragments);
+ le64_to_cpu(sblk->fragment_table_start), next_table, fragments);
if (IS_ERR(msblk->fragment_index)) {
ERROR("unable to read fragment index table\n");
err = PTR_ERR(msblk->fragment_index);