From: Andrew Morton <akpm@linux-foundation.org>
To: Phillip Lougher <phillip@squashfs.org.uk>
Cc: linux-kernel@vger.kernel.org, Yuejie Shi <syjcnss@gmail.com>
Subject: Re: [PATCH] Squashfs: check block offset is not negative
Date: Tue, 4 Aug 2026 13:48:38 -0700 [thread overview]
Message-ID: <20260804134838.393c5c8f7ced5aa5fc799403@linux-foundation.org> (raw)
In-Reply-To: <20260804194037.580032-1-phillip@squashfs.org.uk>
On Tue, 4 Aug 2026 20:40:37 +0100 Phillip Lougher <phillip@squashfs.org.uk> wrote:
> If a negative offset is read off disk (for example the offset into the
> decompressed fragment block), this will cause squashfs_copy_data() to
> perform an out of bounds access.
>
> Fix by checking if offset is negative, and returning 0. This matches
> existing behaviour where an offset beyond the block returns 0 bytes
> copied.
>
> Fixes: f400e12656ab ("Squashfs: cache operations")
I agree with your removal of cc:stable. "crafted image requires
CAP_SYS_ADMIN" isn't a thing we should bother backporting.
It's worth mentioning this in the changelog - let's please develop the
habit of describing the userspace-visible impact of bugs when we fix
them.
prev parent reply other threads:[~2026-08-04 20:48 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-08-04 19:40 [PATCH] Squashfs: check block offset is not negative Phillip Lougher
2026-08-04 20:48 ` Andrew Morton [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260804134838.393c5c8f7ced5aa5fc799403@linux-foundation.org \
--to=akpm@linux-foundation.org \
--cc=linux-kernel@vger.kernel.org \
--cc=phillip@squashfs.org.uk \
--cc=syjcnss@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.