u-boot.git/fs/squashfs/sqfs.c, branch main

fs/squashfs: Set ret to 0 on successful read

2026-04-24T17:28:10Z

It might still be a positive number due to the call to sqfs_disk_read. This only happens when reading a file from an uncompressed squashfs. I found this by trying to boot using the extlinux bootmethod, where positive values are treated as errors. Signed-off-by: Michael Zimmermann Acked-by: Richard Genoud Reviewed-by: Simon Glass

spl: add squashfs support

2026-03-26T17:04:28Z

Implement spl_load_image_sqfs() in spl code. This will be used in MMC to read a file from a squashfs partition. Also, loosen squashfs read checks on file size by not failing when a bigger size than the actual file size is requested. (Just read the file) This is needed for FIT loading, because the length is ALIGNed. Signed-off-by: Richard Genoud Reviewed-by: Miquel Raynal Reviewed-by: João Marcos Costa

fs/squashfs: fix heap buffer overflow in sqfs_frag_lookup()

2026-02-23T18:45:50Z

sqfs_frag_lookup() reads a 16-bit metadata block header whose lower 15 bits encode the data size. Unlike sqfs_read_metablock() in sqfs_inode.c, this function does not validate that the decoded size is within SQFS_METADATA_BLOCK_SIZE (8192). A malformed SquashFS image can set the size field to any value up to 32767, causing memcpy to write past the 8192-byte 'entries' heap buffer. Add the same bounds check used by sqfs_read_metablock(): reject any metadata block header with SQFS_METADATA_SIZE(header) exceeding SQFS_METADATA_BLOCK_SIZE. Found by fuzzing with libFuzzer + AddressSanitizer. Signed-off-by: Eric Kilmer Reviewed-by: Miquel Raynal

fs: prevent integer overflow in sqfs_concat

2026-01-16T19:04:40Z

An integer overflow in length calculation could lead to under-allocation and buffer overcopy. Signed-off-by: Timo tp Preißl Reviewed-by: Tom Rini Reviewed-by: Simon Glass Reviewed-by: João Marcos Costa

fs/squashfs: Ensure memory is freed by using unwind goto

2025-10-10T20:27:49Z

Returning immediately from sqfs_read_nest is not consistent with other error checks in this function and can lead to memory leaks. Instead use the unwind goto used elsewhere to ensure that the memory is freed. This issue was found by Smatch. Signed-off-by: Andrew Goodbody Acked-by: Quentin Schulz Reviewed-by: Joao Marcos Costa

fs/squashfs: avoid illegal free() in sqfs_opendir()

2025-04-21T17:08:03Z

* Use calloc() to allocate token_list. This avoids an illegal free if sqfs_tokenize() fails. * Do not iterate over token_list if it has not been allocated. Addresses-Coverity-ID: 510453: Null pointer dereferences (FORWARD_NULL) Signed-off-by: Heinrich Schuchardt Reviewed-by: Joao Marcos Costa Reviewed-by: Joao Marcos Costa

fs/squashfs: Fix memory leak in sqfs_size_nest()

2025-03-05T18:14:31Z

In case MAX_SYMLINK_NEST is reached while determining the size on a symlink node, the function returns immediately. This would not free the resources after the free_strings: label causing a memory leak. Set the ret value and just break out of the switch to fix this. Signed-off-by: Andrea della Porta Reviewed-by: Miquel Raynal

fs/squashfs: fix potential integer overflows

2025-02-24T14:49:04Z

The length of buffers used to read inode tables, directory tables, and reading a file are calculated as: number of blocks * block size, and such plain multiplication is prone to overflowing (thus unsafe). Replace it by __builtin_mul_overflow, i.e. safe math. Signed-off-by: Joao Marcos Costa

squashfs: Fix heap corruption in sqfs_search_dir()

2024-08-15T22:14:36Z

res needs to be large enough to store both strings rem and target, plus the path separator and the terminator. Currently the space for the path separator is not accounted, so the heap is corrupted by one byte. Signed-off-by: Richard Weinberger Reviewed-by: Miquel Raynal

squashfs: Fix stack overflow while symlink resolving

2024-08-15T22:14:36Z

The squashfs driver blindly follows symlinks, and calls sqfs_size() recursively. So an attacker can create a crafted filesystem and with a deep enough nesting level a stack overflow can be achieved. Fix by limiting the nesting level to 8. Signed-off-by: Richard Weinberger Reviewed-by: Miquel Raynal