From: kernel test robot <lkp@intel.com>
To: Phillip Lougher <phillip@squashfs.org.uk>,
akpm@linux-foundation.org, linux-kernel@vger.kernel.org
Cc: llvm@lists.linux.dev, oe-kbuild-all@lists.linux.dev,
Phillip Lougher <phillip@squashfs.org.uk>
Subject: Re: [PATCH 09/18] Squashfs: sanity check inode metadata block location
Date: Sun, 8 Nov 2026 06:47:54 +0800 [thread overview]
Message-ID: <202611080635.7XPojc0A-lkp@intel.com> (raw)
In-Reply-To: <20261107052843.725239-10-phillip@squashfs.org.uk>
Hi Phillip,
kernel test robot noticed the following build warnings:
[auto build test WARNING on brauner-vfs/vfs.all]
[also build test WARNING on linus/master v7.4-rc1]
[cannot apply to akpm-mm/mm-everything next-20261105]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch#_base_tree_information]
url: https://github.com/intel-lab-lkp/linux/commits/Phillip-Lougher/Squashfs-convert-SQUASHFS_COMPRESSED_-to-inline-functions/20261107-052826
base: https://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs.git vfs.all
patch link: https://lore.kernel.org/r/20261107052843.725239-10-phillip%40squashfs.org.uk
patch subject: [PATCH 09/18] Squashfs: sanity check inode metadata block location
config: loongarch-defconfig (https://download.01.org/0day-ci/archive/20261108/202611080635.7XPojc0A-lkp@intel.com/config)
compiler: clang version 24.0.0git (https://github.com/llvm/llvm-project fc9576e3b179738d99c5babe5cd9d6c1f883e0db)
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20261108/202611080635.7XPojc0A-lkp@intel.com/reproduce)
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202611080635.7XPojc0A-lkp@intel.com/
All warnings (new ones prefixed by >>):
>> fs/squashfs/inode.c:121:6: warning: variable 'err' is used uninitialized whenever 'if' condition is true [-Wsometimes-uninitialized]
121 | if (block < 0)
| ^~~~~~~~~
fs/squashfs/inode.c:454:9: note: uninitialized use occurs here
454 | return err;
| ^~~
fs/squashfs/inode.c:121:2: note: remove the 'if' if its condition is always false
121 | if (block < 0)
| ^~~~~~~~~~~~~~
122 | goto failed_read;
| ~~~~~~~~~~~~~~~~
fs/squashfs/inode.c:114:9: note: initialize the variable 'err' to silence this warning
114 | int err, type;
| ^
| = 0
1 warning generated.
vim +121 fs/squashfs/inode.c
102
103
104 /*
105 * Initialise VFS inode by reading inode from inode table (compressed
106 * metadata). The format and amount of data read depends on type.
107 */
108 int squashfs_read_inode(struct inode *inode, long long ino)
109 {
110 struct super_block *sb = inode->i_sb;
111 struct squashfs_sb_info *msblk = sb->s_fs_info;
112 s64 block = squashfs_inode_start(msblk, ino), sblock = block;
113 int offset = squashfs_inode_offset(ino), soffset = offset;
114 int err, type;
115 union squashfs_inode squashfs_ino;
116 struct squashfs_base_inode *sqshb_ino = &squashfs_ino.base;
117 int xattr_id = SQUASHFS_INVALID_XATTR;
118
119 TRACE("Entered squashfs_read_inode\n");
120
> 121 if (block < 0)
122 goto failed_read;
123 /*
124 * Read inode base common to all inode types.
125 */
126 err = squashfs_read_metadata(sb, sqshb_ino, &sblock,
127 &soffset, sizeof(*sqshb_ino));
128 if (err < 0)
129 goto failed_read;
130
131 err = squashfs_new_inode(sb, inode, sqshb_ino);
132 if (err)
133 goto failed_read;
134
135 type = le16_to_cpu(sqshb_ino->inode_type);
136 switch (type) {
137 case SQUASHFS_REG_TYPE: {
138 unsigned int frag_offset, frag;
139 int frag_size;
140 u64 frag_blk;
141 struct squashfs_reg_inode *sqsh_ino = &squashfs_ino.reg;
142
143 err = squashfs_read_metadata(sb, sqsh_ino, &block, &offset,
144 sizeof(*sqsh_ino));
145 if (err < 0)
146 goto failed_read;
147
148 inode->i_size = le32_to_cpu(sqsh_ino->file_size);
149 frag = le32_to_cpu(sqsh_ino->fragment);
150 if (frag != SQUASHFS_INVALID_FRAG) {
151 /*
152 * the file cannot have a fragment (tailend) and have a
153 * file size a multiple of the block size
154 */
155 if ((inode->i_size & (msblk->block_size - 1)) == 0) {
156 err = -EINVAL;
157 goto failed_read;
158 }
159 frag_offset = le32_to_cpu(sqsh_ino->offset);
160 frag_size = squashfs_frag_lookup(sb, frag, &frag_blk);
161 if (frag_size < 0) {
162 err = frag_size;
163 goto failed_read;
164 }
165 } else {
166 frag_blk = SQUASHFS_INVALID_BLK;
167 frag_size = 0;
168 frag_offset = 0;
169 }
170
171 set_nlink(inode, 1);
172 inode->i_fop = &squashfs_file_operations;
173 inode->i_mode |= S_IFREG;
174 inode->i_blocks = ((inode->i_size - 1) >> 9) + 1;
175 squashfs_i(inode)->fragment_block = frag_blk;
176 squashfs_i(inode)->fragment_size = frag_size;
177 squashfs_i(inode)->fragment_offset = frag_offset;
178 squashfs_i(inode)->start = le32_to_cpu(sqsh_ino->start_block);
179 squashfs_i(inode)->block_list_start = block;
180 squashfs_i(inode)->offset = offset;
181 squashfs_i(inode)->parent = 0;
182 inode->i_data.a_ops = &squashfs_aops;
183
184 TRACE("File inode %x:%x, start_block %llx, block_list_start "
185 "%llx, offset %x\n", squashfs_inode_blk(ino),
186 squashfs_inode_offset(ino), squashfs_i(inode)->start,
187 block, offset);
188 break;
189 }
190 case SQUASHFS_LREG_TYPE: {
191 unsigned int frag_offset, frag;
192 int frag_size;
193 u64 frag_blk;
194 struct squashfs_lreg_inode *sqsh_ino = &squashfs_ino.lreg;
195
196 err = squashfs_read_metadata(sb, sqsh_ino, &block, &offset,
197 sizeof(*sqsh_ino));
198 if (err < 0)
199 goto failed_read;
200
201 inode->i_size = le64_to_cpu(sqsh_ino->file_size);
202 if (inode->i_size < 0) {
203 err = -EINVAL;
204 goto failed_read;
205 }
206 frag = le32_to_cpu(sqsh_ino->fragment);
207 if (frag != SQUASHFS_INVALID_FRAG) {
208 /*
209 * the file cannot have a fragment (tailend) and have a
210 * file size a multiple of the block size
211 */
212 if ((inode->i_size & (msblk->block_size - 1)) == 0) {
213 err = -EINVAL;
214 goto failed_read;
215 }
216 frag_offset = le32_to_cpu(sqsh_ino->offset);
217 frag_size = squashfs_frag_lookup(sb, frag, &frag_blk);
218 if (frag_size < 0) {
219 err = frag_size;
220 goto failed_read;
221 }
222 } else {
223 frag_blk = SQUASHFS_INVALID_BLK;
224 frag_size = 0;
225 frag_offset = 0;
226 }
227
228 xattr_id = le32_to_cpu(sqsh_ino->xattr);
229 set_nlink(inode, le32_to_cpu(sqsh_ino->nlink));
230 inode->i_op = &squashfs_inode_ops;
231 inode->i_fop = &squashfs_file_operations;
232 inode->i_mode |= S_IFREG;
233 inode->i_blocks = (inode->i_size -
234 le64_to_cpu(sqsh_ino->sparse) + 511) >> 9;
235
236 squashfs_i(inode)->fragment_block = frag_blk;
237 squashfs_i(inode)->fragment_size = frag_size;
238 squashfs_i(inode)->fragment_offset = frag_offset;
239 squashfs_i(inode)->start = le64_to_cpu(sqsh_ino->start_block);
240 squashfs_i(inode)->block_list_start = block;
241 squashfs_i(inode)->offset = offset;
242 squashfs_i(inode)->parent = 0;
243 inode->i_data.a_ops = &squashfs_aops;
244
245 TRACE("File inode %x:%x, start_block %llx, block_list_start "
246 "%llx, offset %x\n", squashfs_inode_blk(ino),
247 squashfs_inode_offset(ino), squashfs_i(inode)->start,
248 block, offset);
249 break;
250 }
251 case SQUASHFS_DIR_TYPE: {
252 struct squashfs_dir_inode *sqsh_ino = &squashfs_ino.dir;
253
254 err = squashfs_read_metadata(sb, sqsh_ino, &block, &offset,
255 sizeof(*sqsh_ino));
256 if (err < 0)
257 goto failed_read;
258
259 set_nlink(inode, le32_to_cpu(sqsh_ino->nlink));
260 inode->i_size = le16_to_cpu(sqsh_ino->file_size);
261 inode->i_op = &squashfs_dir_inode_ops;
262 inode->i_fop = &squashfs_dir_ops;
263 inode->i_mode |= S_IFDIR;
264 squashfs_i(inode)->start = le32_to_cpu(sqsh_ino->start_block);
265 squashfs_i(inode)->offset = le16_to_cpu(sqsh_ino->offset);
266 squashfs_i(inode)->dir_idx_cnt = 0;
267 squashfs_i(inode)->parent = le32_to_cpu(sqsh_ino->parent_inode);
268
269 TRACE("Directory inode %x:%x, start_block %llx, offset %x\n",
270 squashfs_inode_blk(ino), squashfs_inode_offset(ino),
271 squashfs_i(inode)->start,
272 le16_to_cpu(sqsh_ino->offset));
273 break;
274 }
275 case SQUASHFS_LDIR_TYPE: {
276 struct squashfs_ldir_inode *sqsh_ino = &squashfs_ino.ldir;
277
278 err = squashfs_read_metadata(sb, sqsh_ino, &block, &offset,
279 sizeof(*sqsh_ino));
280 if (err < 0)
281 goto failed_read;
282
283 xattr_id = le32_to_cpu(sqsh_ino->xattr);
284 set_nlink(inode, le32_to_cpu(sqsh_ino->nlink));
285 inode->i_size = le32_to_cpu(sqsh_ino->file_size);
286 inode->i_op = &squashfs_dir_inode_ops;
287 inode->i_fop = &squashfs_dir_ops;
288 inode->i_mode |= S_IFDIR;
289 squashfs_i(inode)->start = le32_to_cpu(sqsh_ino->start_block);
290 squashfs_i(inode)->offset = le16_to_cpu(sqsh_ino->offset);
291 squashfs_i(inode)->dir_idx_start = block;
292 squashfs_i(inode)->dir_idx_offset = offset;
293 squashfs_i(inode)->dir_idx_cnt = le16_to_cpu(sqsh_ino->i_count);
294 squashfs_i(inode)->parent = le32_to_cpu(sqsh_ino->parent_inode);
295
296 TRACE("Long directory inode %x:%x, start_block %llx, offset "
297 "%x\n", squashfs_inode_blk(ino),
298 squashfs_inode_offset(ino),
299 squashfs_i(inode)->start,
300 le16_to_cpu(sqsh_ino->offset));
301 break;
302 }
303 case SQUASHFS_SYMLINK_TYPE:
304 case SQUASHFS_LSYMLINK_TYPE: {
305 struct squashfs_symlink_inode *sqsh_ino = &squashfs_ino.symlink;
306
307 err = squashfs_read_metadata(sb, sqsh_ino, &block, &offset,
308 sizeof(*sqsh_ino));
309 if (err < 0)
310 goto failed_read;
311
312 inode->i_size = le32_to_cpu(sqsh_ino->symlink_size);
313 if (inode->i_size > PAGE_SIZE) {
314 ERROR("Corrupted symlink\n");
315 return -EINVAL;
316 }
317
318 set_nlink(inode, le32_to_cpu(sqsh_ino->nlink));
319 inode->i_op = &squashfs_symlink_inode_ops;
320 inode_nohighmem(inode);
321 inode->i_data.a_ops = &squashfs_symlink_aops;
322 inode->i_mode |= S_IFLNK;
323 squashfs_i(inode)->start = block;
324 squashfs_i(inode)->offset = offset;
325 squashfs_i(inode)->parent = 0;
326
327 if (type == SQUASHFS_LSYMLINK_TYPE) {
328 __le32 xattr;
329
330 err = squashfs_read_metadata(sb, NULL, &block,
331 &offset, inode->i_size);
332 if (err < 0)
333 goto failed_read;
334 err = squashfs_read_metadata(sb, &xattr, &block,
335 &offset, sizeof(xattr));
336 if (err < 0)
337 goto failed_read;
338 xattr_id = le32_to_cpu(xattr);
339 }
340
341 TRACE("Symbolic link inode %x:%x, start_block %llx, offset "
342 "%x\n", squashfs_inode_blk(ino),
343 squashfs_inode_offset(ino), block, offset);
344 break;
345 }
346 case SQUASHFS_BLKDEV_TYPE:
347 case SQUASHFS_CHRDEV_TYPE: {
348 struct squashfs_dev_inode *sqsh_ino = &squashfs_ino.dev;
349 unsigned int rdev;
350
351 err = squashfs_read_metadata(sb, sqsh_ino, &block, &offset,
352 sizeof(*sqsh_ino));
353 if (err < 0)
354 goto failed_read;
355
356 if (type == SQUASHFS_CHRDEV_TYPE)
357 inode->i_mode |= S_IFCHR;
358 else
359 inode->i_mode |= S_IFBLK;
360 set_nlink(inode, le32_to_cpu(sqsh_ino->nlink));
361 rdev = le32_to_cpu(sqsh_ino->rdev);
362 init_special_inode(inode, inode->i_mode, new_decode_dev(rdev));
363 squashfs_i(inode)->parent = 0;
364
365 TRACE("Device inode %x:%x, rdev %x\n",
366 squashfs_inode_blk(ino),
367 squashfs_inode_offset(ino), rdev);
368 break;
369 }
370 case SQUASHFS_LBLKDEV_TYPE:
371 case SQUASHFS_LCHRDEV_TYPE: {
372 struct squashfs_ldev_inode *sqsh_ino = &squashfs_ino.ldev;
373 unsigned int rdev;
374
375 err = squashfs_read_metadata(sb, sqsh_ino, &block, &offset,
376 sizeof(*sqsh_ino));
377 if (err < 0)
378 goto failed_read;
379
380 if (type == SQUASHFS_LCHRDEV_TYPE)
381 inode->i_mode |= S_IFCHR;
382 else
383 inode->i_mode |= S_IFBLK;
384 xattr_id = le32_to_cpu(sqsh_ino->xattr);
385 inode->i_op = &squashfs_inode_ops;
386 set_nlink(inode, le32_to_cpu(sqsh_ino->nlink));
387 rdev = le32_to_cpu(sqsh_ino->rdev);
388 init_special_inode(inode, inode->i_mode, new_decode_dev(rdev));
389 squashfs_i(inode)->parent = 0;
390
391 TRACE("Device inode %x:%x, rdev %x\n",
392 squashfs_inode_blk(ino), offset, rdev);
393 break;
394 }
395 case SQUASHFS_FIFO_TYPE:
396 case SQUASHFS_SOCKET_TYPE: {
397 struct squashfs_ipc_inode *sqsh_ino = &squashfs_ino.ipc;
398
399 err = squashfs_read_metadata(sb, sqsh_ino, &block, &offset,
400 sizeof(*sqsh_ino));
401 if (err < 0)
402 goto failed_read;
403
404 if (type == SQUASHFS_FIFO_TYPE)
405 inode->i_mode |= S_IFIFO;
406 else
407 inode->i_mode |= S_IFSOCK;
408 set_nlink(inode, le32_to_cpu(sqsh_ino->nlink));
409 init_special_inode(inode, inode->i_mode, 0);
410 squashfs_i(inode)->parent = 0;
411 break;
412 }
413 case SQUASHFS_LFIFO_TYPE:
414 case SQUASHFS_LSOCKET_TYPE: {
415 struct squashfs_lipc_inode *sqsh_ino = &squashfs_ino.lipc;
416
417 err = squashfs_read_metadata(sb, sqsh_ino, &block, &offset,
418 sizeof(*sqsh_ino));
419 if (err < 0)
420 goto failed_read;
421
422 if (type == SQUASHFS_LFIFO_TYPE)
423 inode->i_mode |= S_IFIFO;
424 else
425 inode->i_mode |= S_IFSOCK;
426 xattr_id = le32_to_cpu(sqsh_ino->xattr);
427 inode->i_op = &squashfs_inode_ops;
428 set_nlink(inode, le32_to_cpu(sqsh_ino->nlink));
429 init_special_inode(inode, inode->i_mode, 0);
430 squashfs_i(inode)->parent = 0;
431 break;
432 }
433 default:
434 ERROR("Unknown inode type %d in squashfs_iget!\n", type);
435 return -EINVAL;
436 }
437
438 if (xattr_id != SQUASHFS_INVALID_XATTR && msblk->xattr_id_table) {
439 err = squashfs_xattr_lookup(sb, xattr_id,
440 &squashfs_i(inode)->xattr_count,
441 &squashfs_i(inode)->xattr_size,
442 &squashfs_i(inode)->xattr);
443 if (err < 0)
444 goto failed_read;
445 inode->i_blocks += ((squashfs_i(inode)->xattr_size - 1) >> 9)
446 + 1;
447 } else
448 squashfs_i(inode)->xattr_count = 0;
449
450 return 0;
451
452 failed_read:
453 ERROR("Unable to read inode 0x%llx\n", ino);
454 return err;
455 }
456
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
next prev parent reply other threads:[~2026-11-07 22:48 UTC|newest]
Thread overview: 25+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-11-07 5:28 [PATCH 00/18] Squashfs: fix a lot of AI issues and AI style issues Phillip Lougher
2026-11-07 5:28 ` [PATCH 01/18] Squashfs: convert SQUASHFS_COMPRESSED_* to inline functions Phillip Lougher
2026-11-07 5:28 ` [PATCH 02/18] Squashfs: convert SQUASHFS_INODE_* and SQUASHFS_MKINODE " Phillip Lougher
2026-11-07 5:28 ` [PATCH 03/18] Squashfs: convert SQUASHFS_FRAGMENT_* " Phillip Lougher
2026-11-07 10:05 ` Joe Perches
2026-11-11 23:59 ` Phillip Lougher
2026-11-12 1:13 ` Joe Perches
2026-11-12 2:13 ` Phillip Lougher
2026-11-07 5:28 ` [PATCH 04/18] Squashfs: convert SQUASHFS_LOOKUP_* " Phillip Lougher
2026-11-07 5:28 ` [PATCH 05/18] Squashfs: convert SQUASHFS_ID_* " Phillip Lougher
2026-11-07 5:28 ` [PATCH 06/18] Squashfs: convert SQUASHFS_XATTR_* " Phillip Lougher
2026-11-07 5:28 ` [PATCH 07/18] Squashfs: fix fragment bytes overflow on 32-bit architectures Phillip Lougher
2026-11-07 5:28 ` [PATCH 08/18] Squashfs: fix fragment index table length too large exploit Phillip Lougher
2026-11-07 5:28 ` [PATCH 09/18] Squashfs: sanity check inode metadata block location Phillip Lougher
2026-11-07 22:47 ` kernel test robot [this message]
2026-11-07 5:28 ` [PATCH 10/18] Squashfs: sanity check directory " Phillip Lougher
2026-11-08 1:36 ` kernel test robot
2026-11-07 5:28 ` [PATCH 11/18] Squashfs: widen xattr count variables and add sanity check Phillip Lougher
2026-11-07 5:28 ` [PATCH 12/18] Squashfs: very large files can exceed an int block count Phillip Lougher
2026-11-07 5:28 ` [PATCH 13/18] Squashfs: add more sanity checking to squashfs_block_size() Phillip Lougher
2026-11-07 5:28 ` [PATCH 14/18] Squashfs: sanity check fragment block location and range Phillip Lougher
2026-11-07 5:28 ` [PATCH 15/18] Squashfs: sanity check block list sizes " Phillip Lougher
2026-11-07 5:28 ` [PATCH 16/18] Squashfs: don't store large export table indexes in memory Phillip Lougher
2026-11-07 5:28 ` [PATCH 17/18] Squashfs: don't store large fragment " Phillip Lougher
2026-11-07 5:28 ` [PATCH 18/18] Squashfs: don't store large xattr id " Phillip Lougher
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=202611080635.7XPojc0A-lkp@intel.com \
--to=lkp@intel.com \
--cc=akpm@linux-foundation.org \
--cc=linux-kernel@vger.kernel.org \
--cc=llvm@lists.linux.dev \
--cc=oe-kbuild-all@lists.linux.dev \
--cc=phillip@squashfs.org.uk \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.