From: kernel test robot <lkp@intel.com>
To: oe-kbuild@lists.linux.dev
Cc: lkp@intel.com, Julia Lawall <julia.lawall@inria.fr>
Subject: [akpm-mm:mm-nonmm-unstable 130/152] fs/squashfs/namei.c:141:5-10: WARNING: Unsigned expression compared with zero: block < 0
Date: Sat, 14 Nov 2026 17:47:57 +0100 [thread overview]
Message-ID: <202611141716.fhmOi3Fb-lkp@intel.com> (raw)
BCC: lkp@intel.com
CC: oe-kbuild-all@lists.linux.dev
CC: David Hildenbrand <david@kernel.org>
CC: Andrew Morton <akpm@linux-foundation.org>
CC: Linux Memory Management List <linux-mm@kvack.org>
CC: mm-commits@vger.kernel.org
TO: Phillip Lougher <phillip@squashfs.org.uk>
CC: Andrew Morton <akpm@linux-foundation.org>
CC: Linux Memory Management List <linux-mm@kvack.org>
tree: https://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm.git mm-nonmm-unstable
head: 9bfc44c252525344c5aebf880259647edf35eda8
commit: d0a5fe53cf5d2f8f64bf1791ac8d72e2ae69710a [130/152] Squashfs: sanity check directory metadata block location
:::::: branch date: 15 hours ago
:::::: commit date: 15 hours ago
config: sparc64-randconfig-r2106-20261114 (https://download.01.org/0day-ci/archive/20261114/202611141716.fhmOi3Fb-lkp@intel.com/config)
compiler: clang version 24.0.0git (https://github.com/llvm/llvm-project c0693becb96c1610aeb87445a50df00d58a823cd)
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Reported-by: Julia Lawall <julia.lawall@inria.fr>
| Closes: https://lore.kernel.org/r/202611141716.fhmOi3Fb-lkp@intel.com/
cocci warnings: (new ones prefixed by >>)
>> fs/squashfs/namei.c:141:5-10: WARNING: Unsigned expression compared with zero: block < 0
vim +141 fs/squashfs/namei.c
c88da2c979369e Phillip Lougher 2009-01-05 123
c88da2c979369e Phillip Lougher 2009-01-05 124
c88da2c979369e Phillip Lougher 2009-01-05 125 static struct dentry *squashfs_lookup(struct inode *dir, struct dentry *dentry,
00cd8dd3bf95f2 Al Viro 2012-06-10 126 unsigned int flags)
c88da2c979369e Phillip Lougher 2009-01-05 127 {
c88da2c979369e Phillip Lougher 2009-01-05 128 const unsigned char *name = dentry->d_name.name;
c88da2c979369e Phillip Lougher 2009-01-05 129 int len = dentry->d_name.len;
c88da2c979369e Phillip Lougher 2009-01-05 130 struct inode *inode = NULL;
c88da2c979369e Phillip Lougher 2009-01-05 131 struct squashfs_sb_info *msblk = dir->i_sb->s_fs_info;
c88da2c979369e Phillip Lougher 2009-01-05 132 struct squashfs_dir_header dirh;
d0a5fe53cf5d2f Phillip Lougher 2026-11-11 133 struct squashfs_dir_entry *dire = NULL;
d0a5fe53cf5d2f Phillip Lougher 2026-11-11 134 u64 block = squashfs_dir_start(squashfs_i(dir)->start, msblk);
c88da2c979369e Phillip Lougher 2009-01-05 135 int offset = squashfs_i(dir)->offset;
52e9ce1c0f2060 Phillip Lougher 2013-09-03 136 int err, length;
52e9ce1c0f2060 Phillip Lougher 2013-09-03 137 unsigned int dir_count, size;
c88da2c979369e Phillip Lougher 2009-01-05 138
d0a5fe53cf5d2f Phillip Lougher 2026-11-11 139 TRACE("Entered squashfs_lookup [%llx:%x]\n", squashfs_i(dir)->start, offset);
d0a5fe53cf5d2f Phillip Lougher 2026-11-11 140
d0a5fe53cf5d2f Phillip Lougher 2026-11-11 @141 if (block < 0)
d0a5fe53cf5d2f Phillip Lougher 2026-11-11 142 goto data_error;
c88da2c979369e Phillip Lougher 2009-01-05 143
c88da2c979369e Phillip Lougher 2009-01-05 144 dire = kmalloc(sizeof(*dire) + SQUASHFS_NAME_LEN + 1, GFP_KERNEL);
c88da2c979369e Phillip Lougher 2009-01-05 145 if (dire == NULL) {
c88da2c979369e Phillip Lougher 2009-01-05 146 ERROR("Failed to allocate squashfs_dir_entry\n");
c88da2c979369e Phillip Lougher 2009-01-05 147 return ERR_PTR(-ENOMEM);
c88da2c979369e Phillip Lougher 2009-01-05 148 }
c88da2c979369e Phillip Lougher 2009-01-05 149
c88da2c979369e Phillip Lougher 2009-01-05 150 if (len > SQUASHFS_NAME_LEN) {
c88da2c979369e Phillip Lougher 2009-01-05 151 err = -ENAMETOOLONG;
c88da2c979369e Phillip Lougher 2009-01-05 152 goto failed;
c88da2c979369e Phillip Lougher 2009-01-05 153 }
c88da2c979369e Phillip Lougher 2009-01-05 154
c88da2c979369e Phillip Lougher 2009-01-05 155 length = get_dir_index_using_name(dir->i_sb, &block, &offset,
c88da2c979369e Phillip Lougher 2009-01-05 156 squashfs_i(dir)->dir_idx_start,
c88da2c979369e Phillip Lougher 2009-01-05 157 squashfs_i(dir)->dir_idx_offset,
040bf9a717885d Phillip Lougher 2024-04-03 158 squashfs_i(dir)->dir_idx_cnt, name);
c88da2c979369e Phillip Lougher 2009-01-05 159
c88da2c979369e Phillip Lougher 2009-01-05 160 while (length < i_size_read(dir)) {
c88da2c979369e Phillip Lougher 2009-01-05 161 /*
c88da2c979369e Phillip Lougher 2009-01-05 162 * Read directory header.
c88da2c979369e Phillip Lougher 2009-01-05 163 */
c88da2c979369e Phillip Lougher 2009-01-05 164 err = squashfs_read_metadata(dir->i_sb, &dirh, &block,
c88da2c979369e Phillip Lougher 2009-01-05 165 &offset, sizeof(dirh));
c88da2c979369e Phillip Lougher 2009-01-05 166 if (err < 0)
c88da2c979369e Phillip Lougher 2009-01-05 167 goto read_failure;
c88da2c979369e Phillip Lougher 2009-01-05 168
c88da2c979369e Phillip Lougher 2009-01-05 169 length += sizeof(dirh);
c88da2c979369e Phillip Lougher 2009-01-05 170
c88da2c979369e Phillip Lougher 2009-01-05 171 dir_count = le32_to_cpu(dirh.count) + 1;
44cff8a9ee8a97 Phillip Lougher 2011-03-15 172
4826d83d9c4f6b Ajeet Yadav 2012-02-02 173 if (dir_count > SQUASHFS_DIR_COUNT)
44cff8a9ee8a97 Phillip Lougher 2011-03-15 174 goto data_error;
44cff8a9ee8a97 Phillip Lougher 2011-03-15 175
c88da2c979369e Phillip Lougher 2009-01-05 176 while (dir_count--) {
c88da2c979369e Phillip Lougher 2009-01-05 177 /*
c88da2c979369e Phillip Lougher 2009-01-05 178 * Read directory entry.
c88da2c979369e Phillip Lougher 2009-01-05 179 */
c88da2c979369e Phillip Lougher 2009-01-05 180 err = squashfs_read_metadata(dir->i_sb, dire, &block,
c88da2c979369e Phillip Lougher 2009-01-05 181 &offset, sizeof(*dire));
c88da2c979369e Phillip Lougher 2009-01-05 182 if (err < 0)
c88da2c979369e Phillip Lougher 2009-01-05 183 goto read_failure;
c88da2c979369e Phillip Lougher 2009-01-05 184
c88da2c979369e Phillip Lougher 2009-01-05 185 size = le16_to_cpu(dire->size) + 1;
c88da2c979369e Phillip Lougher 2009-01-05 186
44cff8a9ee8a97 Phillip Lougher 2011-03-15 187 /* size should never be larger than SQUASHFS_NAME_LEN */
44cff8a9ee8a97 Phillip Lougher 2011-03-15 188 if (size > SQUASHFS_NAME_LEN)
44cff8a9ee8a97 Phillip Lougher 2011-03-15 189 goto data_error;
44cff8a9ee8a97 Phillip Lougher 2011-03-15 190
c88da2c979369e Phillip Lougher 2009-01-05 191 err = squashfs_read_metadata(dir->i_sb, dire->name,
c88da2c979369e Phillip Lougher 2009-01-05 192 &block, &offset, size);
c88da2c979369e Phillip Lougher 2009-01-05 193 if (err < 0)
c88da2c979369e Phillip Lougher 2009-01-05 194 goto read_failure;
c88da2c979369e Phillip Lougher 2009-01-05 195
c88da2c979369e Phillip Lougher 2009-01-05 196 length += sizeof(*dire) + size;
c88da2c979369e Phillip Lougher 2009-01-05 197
c88da2c979369e Phillip Lougher 2009-01-05 198 if (name[0] < dire->name[0])
c88da2c979369e Phillip Lougher 2009-01-05 199 goto exit_lookup;
c88da2c979369e Phillip Lougher 2009-01-05 200
c88da2c979369e Phillip Lougher 2009-01-05 201 if (len == size && !strncmp(name, dire->name, len)) {
c88da2c979369e Phillip Lougher 2009-01-05 202 unsigned int blk, off, ino_num;
c88da2c979369e Phillip Lougher 2009-01-05 203 long long ino;
c88da2c979369e Phillip Lougher 2009-01-05 204 blk = le32_to_cpu(dirh.start_block);
c88da2c979369e Phillip Lougher 2009-01-05 205 off = le16_to_cpu(dire->offset);
c88da2c979369e Phillip Lougher 2009-01-05 206 ino_num = le32_to_cpu(dirh.inode_number) +
c88da2c979369e Phillip Lougher 2009-01-05 207 (short) le16_to_cpu(dire->inode_number);
9a6badf613992e Phillip Lougher 2026-11-11 208 ino = squashfs_mkinode(blk, off);
c88da2c979369e Phillip Lougher 2009-01-05 209
c88da2c979369e Phillip Lougher 2009-01-05 210 TRACE("calling squashfs_iget for directory "
c88da2c979369e Phillip Lougher 2009-01-05 211 "entry %s, inode %x:%x, %d\n", name,
c88da2c979369e Phillip Lougher 2009-01-05 212 blk, off, ino_num);
c88da2c979369e Phillip Lougher 2009-01-05 213
c88da2c979369e Phillip Lougher 2009-01-05 214 inode = squashfs_iget(dir->i_sb, ino, ino_num);
c88da2c979369e Phillip Lougher 2009-01-05 215 goto exit_lookup;
c88da2c979369e Phillip Lougher 2009-01-05 216 }
c88da2c979369e Phillip Lougher 2009-01-05 217 }
c88da2c979369e Phillip Lougher 2009-01-05 218 }
c88da2c979369e Phillip Lougher 2009-01-05 219
c88da2c979369e Phillip Lougher 2009-01-05 220 exit_lookup:
c88da2c979369e Phillip Lougher 2009-01-05 221 kfree(dire);
c88da2c979369e Phillip Lougher 2009-01-05 222 return d_splice_alias(inode, dentry);
c88da2c979369e Phillip Lougher 2009-01-05 223
44cff8a9ee8a97 Phillip Lougher 2011-03-15 224 data_error:
44cff8a9ee8a97 Phillip Lougher 2011-03-15 225 err = -EIO;
44cff8a9ee8a97 Phillip Lougher 2011-03-15 226
c88da2c979369e Phillip Lougher 2009-01-05 227 read_failure:
c88da2c979369e Phillip Lougher 2009-01-05 228 ERROR("Unable to read directory block [%llx:%x]\n",
d0a5fe53cf5d2f Phillip Lougher 2026-11-11 229 squashfs_i(dir)->start, squashfs_i(dir)->offset);
c88da2c979369e Phillip Lougher 2009-01-05 230 failed:
c88da2c979369e Phillip Lougher 2009-01-05 231 kfree(dire);
c88da2c979369e Phillip Lougher 2009-01-05 232 return ERR_PTR(err);
c88da2c979369e Phillip Lougher 2009-01-05 233 }
c88da2c979369e Phillip Lougher 2009-01-05 234
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
reply other threads:[~2026-11-14 16:48 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=202611141716.fhmOi3Fb-lkp@intel.com \
--to=lkp@intel.com \
--cc=julia.lawall@inria.fr \
--cc=oe-kbuild@lists.linux.dev \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.