Re: [PATCH 6.1] Squashfs: check the inode number is not the invalid value of zero

[Sasha Levin <sashal@kernel.org>]

[ Sasha's backport helper bot ]

Hi,

✅ All tests passed successfully. No issues detected.
No action required from the submitter.

The upstream commit SHA1 provided is correct: 9253c54e01b6505d348afbc02abaa4d9f8a01395

WARNING: Author mismatch between patch and upstream commit:
Backport author: Xiangyu Chen<xiangyu.chen@eng.windriver.com>
Commit author: Phillip Lougher<phillip@squashfs.org.uk>

Status in newer kernel trees:
6.13.y | Present (exact SHA1)
6.12.y | Present (exact SHA1)
6.6.y | Present (different SHA1: be383effaee3)

Note: The patch differs from the upstream commit:
---
1:  9253c54e01b65 ! 1:  fee0f4eb6fa1f Squashfs: check the inode number is not the invalid value of zero
    @@ Metadata
      ## Commit message ##
         Squashfs: check the inode number is not the invalid value of zero
     
    +    [ upstream commit 9253c54e01b6505d348afbc02abaa4d9f8a01395 ]
    +
         Syskiller has produced an out of bounds access in fill_meta_index().
     
         That out of bounds access is ultimately caused because the inode
    @@ Commit message
         Cc: Christian Brauner <brauner@kernel.org>
         Cc: <stable@vger.kernel.org>
         Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    +    Signed-off-by: Xiangyu Chen <xiangyu.chen@windriver.com>
    +    Signed-off-by: He Zhe <zhe.he@windriver.com>
     
      ## fs/squashfs/inode.c ##
     @@ fs/squashfs/inode.c: static int squashfs_new_inode(struct super_block *sb, struct inode *inode,
    @@ fs/squashfs/inode.c: static int squashfs_new_inode(struct super_block *sb, struc
      	i_uid_write(inode, i_uid);
      	i_gid_write(inode, i_gid);
     -	inode->i_ino = le32_to_cpu(sqsh_ino->inode_number);
    - 	inode_set_mtime(inode, le32_to_cpu(sqsh_ino->mtime), 0);
    - 	inode_set_atime(inode, inode_get_mtime_sec(inode), 0);
    - 	inode_set_ctime(inode, inode_get_mtime_sec(inode), 0);
    + 	inode->i_mtime.tv_sec = le32_to_cpu(sqsh_ino->mtime);
    + 	inode->i_atime.tv_sec = inode->i_mtime.tv_sec;
    + 	inode->i_ctime.tv_sec = inode->i_mtime.tv_sec;
---

Results of testing on various branches:

| Branch                    | Patch Apply | Build Test |
|---------------------------|-------------|------------|
| stable/linux-6.1.y        |  Success    |  Success   |