[PATCH] Squashfs: check block offset is not negative

[PATCH] Squashfs: check block offset is not negative

[Phillip Lougher]

If a negative offset is read off disk (for example the offset into the
decompressed fragment block), this will cause squashfs_copy_data() to
perform an out of bounds access.

Fix by checking if offset is negative, and returning 0.  This matches
existing behaviour where an offset beyond the block returns 0 bytes
copied.

Fixes: f400e12656ab ("Squashfs: cache operations")
Reported-by: Yuejie Shi <syjcnss@gmail.com>
Closes: https://lore.kernel.org/all/20260803032735.81785-1-syjcnss@gmail.com/
Signed-off-by: Phillip Lougher <phillip@squashfs.org.uk>
---
 fs/squashfs/cache.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/squashfs/cache.c b/fs/squashfs/cache.c
index 67abd4dff222..2807b80d46b7 100644
--- a/fs/squashfs/cache.c
+++ b/fs/squashfs/cache.c
@@ -299,7 +299,7 @@ int squashfs_copy_data(void *buffer, struct squashfs_cache_entry *entry,
 {
 	int remaining = length;
 
-	if (length == 0)
+	if (length == 0 || offset < 0)
 		return 0;
 	else if (buffer == NULL)
 		return min(length, entry->length - offset);
-- 
2.47.3

Re: [PATCH] Squashfs: check block offset is not negative

[Andrew Morton]

On Tue,  4 Aug 2026 20:40:37 +0100 Phillip Lougher <phillip@squashfs.org.uk> wrote:

> If a negative offset is read off disk (for example the offset into the
> decompressed fragment block), this will cause squashfs_copy_data() to
> perform an out of bounds access.
> 
> Fix by checking if offset is negative, and returning 0.  This matches
> existing behaviour where an offset beyond the block returns 0 bytes
> copied.
> 
> Fixes: f400e12656ab ("Squashfs: cache operations")

I agree with your removal of cc:stable.  "crafted image requires
CAP_SYS_ADMIN" isn't a thing we should bother backporting.

It's worth mentioning this in the changelog - let's please develop the
habit of describing the userspace-visible impact of bugs when we fix
them.