From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from sxplsmtpa04-01.prod.sxb1.secureserver.net (sxplsmtpa04-01.prod.sxb1.secureserver.net [188.121.53.5]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 185D347AF61 for ; Tue, 4 Aug 2026 20:26:32 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=188.121.53.5 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785875196; cv=none; b=MkhYgQYbjubbjTmzu2vQ+v4GlR8hdSgVX3iAnZhPQipZ2BsxSsIy0mQV1EZs8XPUQRfsMZNtZkx58qehseYpkXh7OXF95KzeFqS+zNXJscqlYY1DPjZv66UfLZLBrfZ+ikoeENsggR3eVGBaHE1vMknHoKnPaFnE2DyX5L+a+nU= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785875196; c=relaxed/simple; bh=9nTYBv8eGExouIGDKmKTXD8NoOMEUFn/R8XFi9KuwxE=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=svZ2aZVvbqiuD7HMNSDuPYL6KWlWAn9eggQCQ8Jphf9tIDGdHpffnXJb0z92WtMjptijD3ov3qL5pVMorZe9AUdh9pwxXIYPaaoYwmaEU4awIy810M7V3p3xRjSDy1aQV/6NjnCp8wLcCwpn/V5vln8dZIwXDPLzUry1MGuJVL0= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=squashfs.org.uk; spf=pass smtp.mailfrom=squashfs.org.uk; dkim=pass (2048-bit key) header.d=secureserver.net header.i=@secureserver.net header.b=IvVXt4Uw; dkim=pass (2048-bit key) header.d=squashfs.org.uk header.i=@squashfs.org.uk header.b=mROx9QSE; arc=none smtp.client-ip=188.121.53.5 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=squashfs.org.uk Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=squashfs.org.uk Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=secureserver.net header.i=@secureserver.net header.b="IvVXt4Uw"; dkim=pass (2048-bit key) header.d=squashfs.org.uk header.i=@squashfs.org.uk header.b="mROx9QSE" Received: from avalon.fritz.box ([82.69.79.175]) by :SMTPAUTH: with ESMTPA id rL0ywXvixgiPgrL1CwsCOW; Tue, 04 Aug 2026 19:41:43 +0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=secureserver.net; s=secureserver2; t=1785872505; bh=+ztWdASd+dWxuVmu7+qolcV50arzjJqDBWc34+4rf5M=; h=From:To:Cc:Subject:Date; b=IvVXt4UwpJ0jzSJTov0e7uck0BF/YeHNxVGEhmqnHu/gGs5zJ8uh27zaTMruynzmX uXy4kpxPfWNcnaGsSxpjmVACtv+GI8oS+DAlKUb5iA/KZ2GP4if74DZkt0+5aX3Cxg a0pRaL16qBavTy/QKlXfejbDtdSuu+tdFtJ7ph1Cc8JTT8FxNGvvul/omnIWqdJDs1 qlJsXr+532W3vdJjtXBsMpObyIjaAhn/VgbcTO0uG9QP73R/YdFeScMXFDFv3+73uX 5Gu4kcIC2h/XBCID7JudOirQdgPz6a3xO8b5pr9K70z7FCEv4dVQsZm5R2pdLJc7Po 1kt5vlbLjqGFA== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=squashfs.org.uk; s=secureserver2; t=1785872505; bh=+ztWdASd+dWxuVmu7+qolcV50arzjJqDBWc34+4rf5M=; h=From:To:Cc:Subject:Date; b=mROx9QSE+KormDY2Yspy+DJVgLe77uYvoAjjKbkQGjs0NQYzABf41z4YEN1ndBMZR SkerETGgmFZkZrPJdvncxWo4CV0PyxojzY8OoysD4c7mECSKKMQyQyagzrPlvjfF7f tZjJGO6xZTaQmYg0hHTS1Gvul6n0EQA3MKIEsX7xQTbJZYCb998cBVXWWxOSLHFqDh V8f8guh6B+PeY73bMAQuHtJr9+YZRQln9rTKa8arnjnnQ8Oet4PaJ/mEMHg7BzMvBj lRmqPyR8WX2k/8Q0ol5cisaY8InirT5PkfeNtHLcuyoMxwl/fJ9jrBrbv1A099gQ1P zvBcGNdbpaHQw== X-CMAE-Analysis: v=2.4 cv=XLyJoQhE c=1 sm=1 tr=0 ts=6a724078 a=84ok6UeoqCVsigPHarzEiQ==:117 a=84ok6UeoqCVsigPHarzEiQ==:17 a=VwQbUJbxAAAA:8 a=pGLkceISAAAA:8 a=FXvPX3liAAAA:8 a=iOY-L8b0Odu9K5TEecYA:9 a=UObqyxdv-6Yh2QiB9mM_:22 Feedback-ID: 2f789a998bb639c38e4e4cebb723f1ef:squashfs.org.uk:ssnet X-SECURESERVER-ACCT: phillip@squashfs.org.uk From: Phillip Lougher To: linux-kernel@vger.kernel.org, akpm@linux-foundation.org Cc: Phillip Lougher , Yuejie Shi Subject: [PATCH] Squashfs: check block offset is not negative Date: Tue, 4 Aug 2026 20:40:37 +0100 Message-ID: <20260804194037.580032-1-phillip@squashfs.org.uk> X-Mailer: git-send-email 2.47.3 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-CMAE-Envelope: MS4xfENYqRLeMK3W5QmfERO1hkOAT/v0/l6EJDLA2QtI7saYfz/4tv+FUMMlVaoiwaCMGDaCVAJmB2AxuXvufv3zWKDXVhV9405lNEh1XOkYEWQAxjbRflMP V0kJ9CodBG/ylYD5FbO6WM7fUHCjuv1Yomb5WfNJ/SXjKRm9n2qieNASjCPSA5Oay62cv266RFdK4wuEYHzTR+MGIyDEiscdYWe473JtMcSi5wda9wX7Vbv1 LaSLYA0jAAk15e1cRmFd+BI/f97KrQA+5FeF0oi6D15yqQirGojiMjwbXRyTyZABd3KJ8RsniwlQUyq3gROV9w== If a negative offset is read off disk (for example the offset into the decompressed fragment block), this will cause squashfs_copy_data() to perform an out of bounds access. Fix by checking if offset is negative, and returning 0. This matches existing behaviour where an offset beyond the block returns 0 bytes copied. Fixes: f400e12656ab ("Squashfs: cache operations") Reported-by: Yuejie Shi Closes: https://lore.kernel.org/all/20260803032735.81785-1-syjcnss@gmail.com/ Signed-off-by: Phillip Lougher --- fs/squashfs/cache.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/squashfs/cache.c b/fs/squashfs/cache.c index 67abd4dff222..2807b80d46b7 100644 --- a/fs/squashfs/cache.c +++ b/fs/squashfs/cache.c @@ -299,7 +299,7 @@ int squashfs_copy_data(void *buffer, struct squashfs_cache_entry *entry, { int remaining = length; - if (length == 0) + if (length == 0 || offset < 0) return 0; else if (buffer == NULL) return min(length, entry->length - offset); -- 2.47.3