u-boot.git/fs/squashfs, branch main

Merge patch series "fs/squashfs: fix two out-of-bounds reads on crafted images"

2026-08-28T15:00:06Z

Piyush Paliwal says: Two independent out-of-bounds reads in the SquashFS driver, both reachable by pointing U-Boot at an attacker-supplied image (e.g. ls/load on a crafted USB/SD/netboot rootfs). Either one crashes the bootloader (DoS); patch 2 can also copy adjacent heap memory into the loaded file (information disclosure). 1/2 sqfs_find_inode()/sqfs_inode_size() walk the decompressed inode table using on-disk sizes with no check that the cursor stays inside the buffer -> wild read / SEGV, e.g. from a simple "ls". 2/2 sqfs_read_nest() uses the on-disk fragment offset as an unbounded source index into the fragment block -> out-of-bounds heap read when loading a fragment-backed file. Both were found by fuzzing the sandbox build (CONFIG_ASAN) of sqfsls/sqfsload with mutated images. With the fixes, the crashing inputs are rejected cleanly, 2000 fuzz iterations produce no further crashes, and the valid-image path is unchanged. These are distinct from the 2024 SquashFS CVE cluster (CVE-2024-57254..57259, fixed in 2025.01-rc1) and from the sqfs_frag_lookup() fix (e365a269df5): the earlier work added NULL checks at the callers and fixed the symlink-size and fragment-table paths, but left these inode-table-walk and fragment-data paths unbounded. The two patches are independent and can be applied in either order. Link: https://lore.kernel.org/r/20260612075424.83462-1-piyushthepal@gmail.com

fs/squashfs: bound fragment offset/size in sqfs_read_nest()

2026-08-28T14:55:57Z

When reading a fragment-backed file, sqfs_read_nest() copies the file data out of the fragment block with: memcpy(buf + *actread, &fragment_block[finfo.offset], finfo.size - *actread); finfo.offset (the fragment's byte offset) and finfo.size come straight from the on-disk inode and are never validated against the fragment block length. Unlike the data-block loop above it, this path does not clamp the source span, so a crafted inode makes the memcpy read past the fragment buffer -> out-of-bounds heap read. The leaked bytes are copied into the user-visible load buffer (information disclosure) or fault. This affects both the compressed (dest_len bytes) and the uncompressed (table_size bytes) fragment cases. Validate finfo.offset and the copy length against the available fragment data before each memcpy and reject malformed inodes. Found by fuzzing the sandbox (CONFIG_ASAN) sqfsload with mutated images: before, SEGV in sqfs_read_nest() at the fragment memcpy; after, malformed images are rejected and valid fragmented files still load correctly. Fixes: 0008d8086649 ("fs/squashfs: fix reading of fragmented files") Cc: stable@vger.kernel.org Signed-off-by: Piyush Paliwal Reviewed-by: Richard Genoud

fs/squashfs: bound the inode table walk in sqfs_find_inode()

2026-08-28T14:55:57Z

sqfs_find_inode() walks the decompressed inode table advancing "offset += sqfs_inode_size(base, ...)" with no check that offset stays within the table (metablks_count * SQFS_METADATA_BLOCK_SIZE). All sizes come from the on-disk image, including the unbounded extended-directory (LDIR) index walk and the regular-file block-list term in sqfs_inode_size(). A crafted image makes base run off the end of the buffer -> out-of-bounds read / SEGV, reachable simply by listing the image (ls/sqfsls) or any operation that resolves a path. The earlier fix 3fb1df1e5 ("squashfs: Check sqfs_find_inode() return value") only added NULL checks at the call sites; it did not add the missing internal bound, so the wild read still occurs before the function can return. c8e929e5 fixed only the symlink case of sqfs_inode_size(), leaving the LDIR index walk unbounded. Thread the inode table size from sqfs_read_inode_table() through the squashfs_dir_stream to sqfs_find_inode(), and: - reject an inode whose base header does not fit in the table; - pass the remaining byte count to sqfs_inode_size() and validate every variable-length read (LDIR index list, REG/LREG block list, symlink, device/ipc inodes) against it, with overflow-checked arithmetic; - reject an inode whose computed size leaves the table. Found by fuzzing the sandbox (CONFIG_ASAN) sqfsls/sqfsload with mutated images. Before: SEGV in sqfs_find_inode (sqfs_inode.c) and in sqfs_inode_size() LDIR walk. After: malformed images are rejected cleanly; 2000 fuzz iterations produce no crash and the valid-image path is unchanged. Fixes: c51006130370 ("fs/squashfs: new filesystem") Cc: stable@vger.kernel.org Signed-off-by: Piyush Paliwal Reviewed-by: Richard Genoud

Merge patch series "fs/squashfs: fix directory table integer overflow"

2026-08-27T21:05:06Z

Shahriyar Jalayeri says: This fixes an integer overflow in the SquashFS directory-table reader that leads to a heap out-of-bounds write, and adds a regression test. sqfs_read_directory_table() sizes the directory table with an int multiply (metablks_count * SQFS_METADATA_BLOCK_SIZE) that wraps for a crafted image, under-allocating the buffer that the fill loop then overruns. It is reached by listing or reading the image (sqfsls / sqfsload). Patch 1 guards the allocation with __builtin_mul_overflow(); patch 2 adds a test that a crafted image is rejected. Based on v2026.07 (fdfe2ec48d5c). A reproducer is available on request. [trini: As part of the merge, this touches on what commit 9a9d46cb5e1a ("fs/squashfs: fix heap exhaustion during symlink resolution") also handles, but they appear to be separate issues] Link: https://lore.kernel.org/r/20260728-sqfs-oob-fix-v2-0-077d9f0e01c4@byteray.co.uk

fs/squashfs: fix integer overflow in directory table allocation

2026-08-27T21:01:02Z

sqfs_read_directory_table() allocates the directory table with malloc(metablks_count * SQFS_METADATA_BLOCK_SIZE). metablks_count is an int and SQFS_METADATA_BLOCK_SIZE is 8192, so the multiply is evaluated in int and wraps for metablks_count >= 2^19. metablks_count comes from the attacker-controlled superblock (sqfs_count_metablks() grows it by one per 2-byte metadata header), so a crafted image under-allocates the buffer while the fill loop still writes metablks_count metadata blocks into it, a heap out-of-bounds write. It is reached by listing or reading the image (sqfsls / sqfsload). The position list allocation on the next line has the same unchecked-multiply shape. Size both allocations with __builtin_mul_overflow() and reject the image on overflow, as the disk-read buffers earlier in the same function already do. Set the error return when either allocation fails so the caller does not proceed with a NULL directory table. Fixes: c51006130370 ("fs/squashfs: new filesystem") Signed-off-by: Shahriyar Jalayeri Reviewed-by: Richard Genoud

fs/squashfs: bound the offset returned by sqfs_dir_offset()

2026-08-27T21:00:03Z

Commit 57e0bb7bf00d ("fs/squashfs: add sqfs_dir_offset() error checks") made sqfs_search_dir() reject negative returns from sqfs_dir_offset(), but the positive range is still unbounded. Both parts of the returned offset come from the image: 'offset' is a 16-bit inode field used verbatim, and the matched metadata block index may be the last one in m_list, in which case the returned block (j + 1) is one past the end of the directory table. The callers use the result to index dirs->dir_table[], which sqfs_read_directory_table() allocates as m_count metadata blocks, and then memcpy() a directory header out of it. A crafted image can therefore read up to 64 KiB past the end of that allocation. Reject an inode offset that cannot address a decompressed metadata block, and verify that the resulting directory header lies entirely within the directory table. The existing 'offset < 0' test is dropped: 'offset' is assigned from get_unaligned_le16() and so is never negative, meaning the test never fired. The new upper bound covers what it was meant to catch. Fixes: c51006130370 ("fs/squashfs: new filesystem") Signed-off-by: Pranav Rajendran Reviewed-by: Richard Genoud

fs/squashfs: bound fragment table accesses in sqfs_frag_lookup()

2026-08-27T21:00:03Z

sqfs_frag_lookup() validates its fragment index only against sblk->fragments, which is read from the image superblock and is therefore under the control of whoever supplies the image. Every buffer access derived from that index is then made without checking it against the size of the buffer actually read from the device: - the fragment index table entry at 'table_offset + block * sizeof(u64)' can be read past the end of 'table', as 'block' is inode_fragment_index / SQFS_MAX_ENTRIES and has no upper bound; - the metadata block header and payload are read from 'metadata_buffer' at 'table_offset', but that buffer is sized from start_block, which comes from the unvalidated index table entry above. A start_block just below sblk->fragment_table_start yields a single-block buffer while SQFS_METADATA_SIZE(header) may be up to SQFS_METADATA_BLOCK_SIZE, so both the decompression source and the memcpy() source can run past the end of the buffer; - 'entries' is allocated with SQFS_METADATA_BLOCK_SIZE bytes but only partially filled, so entries[offset] can read uninitialised heap memory when the metadata block holds fewer than offset + 1 entries. Compute the size of both buffers explicitly, rejecting the multiplication overflow the way sqfs_read_directory_table() already does, and check each access against it. Also track how much of 'entries' was populated and reject an index beyond that. A crafted SquashFS image can trigger all three cases, either crashing U-Boot or feeding adjacent heap contents into the fragment entry that the following data read is based on. Fixes: c51006130370 ("fs/squashfs: new filesystem") Signed-off-by: Pranav Rajendran Reviewed-by: Richard Genoud

Merge patch series "fs/squashfs: fix symlink load failure on large images"

2026-07-25T13:55:35Z

Allan ELKAIM says: sqfsload fails to load a file through a symlink when the squashfs image contains a large number of inodes (e.g. a rootfs that includes the tzdata timezone database). Root cause: sqfs_read_nest() resolves the symlink by calling itself recursively without first freeing the parent directory's inode and directory table buffers. This causes a temporary double allocation that can exhaust the U-Boot heap. When malloc() subsequently fails inside sqfs_read_directory_table(), the error goes undetected and sqfs_search_dir() is called with a NULL pos_list pointer, leading to: Error: invalid inode reference to directory table. Failed to load '/boot/Image' Patch 1 fixes the structural problem (temporary double allocation) and plugs the silent NULL pointer path in sqfs_read_directory_table(). Patch 2 adds the missing return-value checks on sqfs_dir_offset() that turn any residual lookup failure into a clean error propagation. Patch 3 (reworked in v3 following Richard Genoud's review) fixes pre-existing leaks of dirs->entry on the error paths of sqfs_search_dir(), by centralizing the cleanup at the 'out' label. All patches are independent and can be reviewed separately. The bug was first observed on U-Boot v2024.01 and is still present on v2026.04. The patches have been tested on a Raspberry Pi CM4 running U-Boot v2026.04 (Yocto Scarthgap 5.0.17) with a 325 MB squashfs rootfs containing 22 517 inodes. The symlink /boot/Image -> Image-6.6.63-v8 now resolves successfully. This series addresses the bug reported at: https://lists.u-boot-project.org/pipermail/u-boot/2026-May/618533.html Link: https://lore.kernel.org/r/20260713142420.2618339-1-allan.elkaim@gmail.com

fs/squashfs: fix dirs->entry leaks on sqfs_search_dir() error paths

2026-07-25T00:39:29Z

Several error paths in sqfs_search_dir() return through 'goto out' while a directory entry obtained from sqfs_readdir_nest() is still held, leaking dirs->entry: the inode lookup failure, the symlink nesting limit check, every allocation/tokenization failure during symlink resolution, and the case where readdir aborts after an entry was already read. Instead of freeing dirs->entry at each error site, centralize the cleanup at the 'out' label: on error, no valid entry may be handed back to the caller, so it can be freed unconditionally there. On success, dirs->entry is already NULL: it is freed at the end of each token iteration and before recursing into a symlink target, and the root directory path never allocates it. Explicit frees remain only where a success path needs them: between reads in the readdir loop, at the end of each token iteration, and before the recursive call. The now-redundant frees on individual error paths are removed. Suggested-by: Richard Genoud Signed-off-by: Allan ELKAIM

fs/squashfs: add sqfs_dir_offset() error checks

2026-07-25T00:39:29Z

sqfs_dir_offset() returns a negative errno on failure, but three call sites in sqfs_search_dir() use the return value as an array index without checking for errors first. If the lookup fails, dirs->table is set to an invalid address, leading to undefined behavior. Add negative-value guards after each sqfs_dir_offset() call so that any lookup failure propagates cleanly as an error rather than producing incorrect results. Note: the corresponding sqfs_find_inode() NULL checks and the heap exhaustion fix during symlink resolution are applied in separate patches. Acked-by: Miquel Raynal Reviewed-by: Richard Genoud Signed-off-by: Allan ELKAIM