Revision d6e621de1fceb3b098ebf435ef7ea91ec4838a1a authored by Phillip Lougher on 15 May 2021, 00:27:16 UTC, committed by Linus Torvalds on 15 May 2021, 02:41:32 UTC
Sysbot has reported a "divide error" which has been identified as being
caused by a corrupted file_size value within the file inode.  This value
has been corrupted to a much larger value than expected.

Calculate_skip() is passed i_size_read(inode) >> msblk->block_log.  Due to
the file_size value corruption this overflows the int argument/variable in
that function, leading to the divide error.

This patch changes the function to use u64.  This will accommodate any
unexpectedly large values due to corruption.

The value returned from calculate_skip() is clamped to be never more than
SQUASHFS_CACHED_BLKS - 1, or 7.  So file_size corruption does not lead to
an unexpectedly large return result here.

Link: https://lkml.kernel.org/r/20210507152618.9447-1-phillip@squashfs.org.uk
Signed-off-by: Phillip Lougher <phillip@squashfs.org.uk>
Reported-by: <syzbot+e8f781243ce16ac2f962@syzkaller.appspotmail.com>
Reported-by: <syzbot+7b98870d4fec9447b951@syzkaller.appspotmail.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
1 parent eb1f065
Raw File
const_structs.checkpatch
acpi_dock_ops
address_space_operations
backlight_ops
block_device_operations
clk_ops
comedi_lrange
component_ops
dentry_operations
dev_pm_ops
dma_map_ops
driver_info
drm_connector_funcs
drm_encoder_funcs
drm_encoder_helper_funcs
ethtool_ops
extent_io_ops
file_lock_operations
file_operations
hv_ops
ide_dma_ops
ide_port_ops
inode_operations
intel_dvo_dev_ops
irq_domain_ops
item_operations
iwl_cfg
iwl_ops
kgdb_arch
kgdb_io
kset_uevent_ops
lock_manager_operations
machine_desc
microcode_ops
mlxsw_reg_info
mtrr_ops
neigh_ops
net_device_ops
nlmsvc_binding
nvkm_device_chip
of_device_id
pci_raw_ops
phy_ops
pinctrl_ops
pinmux_ops
pipe_buf_operations
platform_hibernation_ops
platform_suspend_ops
proto_ops
regmap_access_table
regulator_ops
rpc_pipe_ops
rtc_class_ops
sd_desc
seq_operations
sirfsoc_padmux
snd_ac97_build_ops
snd_soc_component_driver
soc_pcmcia_socket_ops
stacktrace_ops
sysfs_ops
tty_operations
uart_ops
usb_mon_operations
v4l2_ctrl_ops
v4l2_ioctl_ops
vm_operations_struct
wacom_features
wd_ops
back to top