diff options
| author | Dave Airlie <airlied@redhat.com> | 2018-07-30 03:39:22 +0300 |
|---|---|---|
| committer | Dave Airlie <airlied@redhat.com> | 2018-07-30 03:39:22 +0300 |
| commit | 3fce4618279373efc59a91adb16c11da46cd69e5 (patch) | |
| tree | 086fad6c9f260a0bcc9b6a3532c6cddc387dd907 /fs/squashfs | |
| parent | ecd7963f7cf967009882fd56eaee1e87a229bea2 (diff) | |
| parent | acb1872577b346bd15ab3a3f8dff780d6cca4b70 (diff) | |
| download | linux-3fce4618279373efc59a91adb16c11da46cd69e5.tar.xz | |
BackMerge v4.18-rc7 into drm-next
rmk requested this for armada and I think we've had a few
conflicts build up.
Signed-off-by: Dave Airlie <airlied@redhat.com>
Diffstat (limited to 'fs/squashfs')
| -rw-r--r-- | fs/squashfs/cache.c | 3 | ||||
| -rw-r--r-- | fs/squashfs/file.c | 8 | ||||
| -rw-r--r-- | fs/squashfs/fragment.c | 4 | ||||
| -rw-r--r-- | fs/squashfs/squashfs_fs.h | 6 |
4 files changed, 16 insertions, 5 deletions
diff --git a/fs/squashfs/cache.c b/fs/squashfs/cache.c index 23813c078cc9..0839efa720b3 100644 --- a/fs/squashfs/cache.c +++ b/fs/squashfs/cache.c @@ -350,6 +350,9 @@ int squashfs_read_metadata(struct super_block *sb, void *buffer, TRACE("Entered squashfs_read_metadata [%llx:%x]\n", *block, *offset); + if (unlikely(length < 0)) + return -EIO; + while (length) { entry = squashfs_cache_get(sb, msblk->block_cache, *block, 0); if (entry->error) { diff --git a/fs/squashfs/file.c b/fs/squashfs/file.c index 13d80947bf9e..fcff2e0487fe 100644 --- a/fs/squashfs/file.c +++ b/fs/squashfs/file.c @@ -194,7 +194,11 @@ static long long read_indexes(struct super_block *sb, int n, } for (i = 0; i < blocks; i++) { - int size = le32_to_cpu(blist[i]); + int size = squashfs_block_size(blist[i]); + if (size < 0) { + err = size; + goto failure; + } block += SQUASHFS_COMPRESSED_SIZE_BLOCK(size); } n -= blocks; @@ -367,7 +371,7 @@ static int read_blocklist(struct inode *inode, int index, u64 *block) sizeof(size)); if (res < 0) return res; - return le32_to_cpu(size); + return squashfs_block_size(size); } /* Copy data into page cache */ diff --git a/fs/squashfs/fragment.c b/fs/squashfs/fragment.c index 0ed6edbc5c71..86ad9a4b8c36 100644 --- a/fs/squashfs/fragment.c +++ b/fs/squashfs/fragment.c @@ -61,9 +61,7 @@ int squashfs_frag_lookup(struct super_block *sb, unsigned int fragment, return size; *fragment_block = le64_to_cpu(fragment_entry.start_block); - size = le32_to_cpu(fragment_entry.size); - - return size; + return squashfs_block_size(fragment_entry.size); } diff --git a/fs/squashfs/squashfs_fs.h b/fs/squashfs/squashfs_fs.h index 24d12fd14177..4e6853f084d0 100644 --- a/fs/squashfs/squashfs_fs.h +++ b/fs/squashfs/squashfs_fs.h @@ -129,6 +129,12 @@ #define SQUASHFS_COMPRESSED_BLOCK(B) (!((B) & SQUASHFS_COMPRESSED_BIT_BLOCK)) +static inline int squashfs_block_size(__le32 raw) +{ + u32 size = le32_to_cpu(raw); + return (size >> 25) ? -EIO : size; +} + /* * Inode number ops. Inodes consist of a compressed block number, and an * uncompressed offset within that block |