u-boot.git/fs/squashfs, branch next

Merge patch series "fs/squashfs: fix symlink load failure on large images"

2026-07-25T13:55:35Z

Allan ELKAIM says: sqfsload fails to load a file through a symlink when the squashfs image contains a large number of inodes (e.g. a rootfs that includes the tzdata timezone database). Root cause: sqfs_read_nest() resolves the symlink by calling itself recursively without first freeing the parent directory's inode and directory table buffers. This causes a temporary double allocation that can exhaust the U-Boot heap. When malloc() subsequently fails inside sqfs_read_directory_table(), the error goes undetected and sqfs_search_dir() is called with a NULL pos_list pointer, leading to: Error: invalid inode reference to directory table. Failed to load '/boot/Image' Patch 1 fixes the structural problem (temporary double allocation) and plugs the silent NULL pointer path in sqfs_read_directory_table(). Patch 2 adds the missing return-value checks on sqfs_dir_offset() that turn any residual lookup failure into a clean error propagation. Patch 3 (reworked in v3 following Richard Genoud's review) fixes pre-existing leaks of dirs->entry on the error paths of sqfs_search_dir(), by centralizing the cleanup at the 'out' label. All patches are independent and can be reviewed separately. The bug was first observed on U-Boot v2024.01 and is still present on v2026.04. The patches have been tested on a Raspberry Pi CM4 running U-Boot v2026.04 (Yocto Scarthgap 5.0.17) with a 325 MB squashfs rootfs containing 22 517 inodes. The symlink /boot/Image -> Image-6.6.63-v8 now resolves successfully. This series addresses the bug reported at: https://lists.u-boot-project.org/pipermail/u-boot/2026-May/618533.html Link: https://lore.kernel.org/r/20260713142420.2618339-1-allan.elkaim@gmail.com

fs/squashfs: fix dirs->entry leaks on sqfs_search_dir() error paths

2026-07-25T00:39:29Z

Several error paths in sqfs_search_dir() return through 'goto out' while a directory entry obtained from sqfs_readdir_nest() is still held, leaking dirs->entry: the inode lookup failure, the symlink nesting limit check, every allocation/tokenization failure during symlink resolution, and the case where readdir aborts after an entry was already read. Instead of freeing dirs->entry at each error site, centralize the cleanup at the 'out' label: on error, no valid entry may be handed back to the caller, so it can be freed unconditionally there. On success, dirs->entry is already NULL: it is freed at the end of each token iteration and before recursing into a symlink target, and the root directory path never allocates it. Explicit frees remain only where a success path needs them: between reads in the readdir loop, at the end of each token iteration, and before the recursive call. The now-redundant frees on individual error paths are removed. Suggested-by: Richard Genoud Signed-off-by: Allan ELKAIM

fs/squashfs: add sqfs_dir_offset() error checks

2026-07-25T00:39:29Z

sqfs_dir_offset() returns a negative errno on failure, but three call sites in sqfs_search_dir() use the return value as an array index without checking for errors first. If the lookup fails, dirs->table is set to an invalid address, leading to undefined behavior. Add negative-value guards after each sqfs_dir_offset() call so that any lookup failure propagates cleanly as an error rather than producing incorrect results. Note: the corresponding sqfs_find_inode() NULL checks and the heap exhaustion fix during symlink resolution are applied in separate patches. Acked-by: Miquel Raynal Reviewed-by: Richard Genoud Signed-off-by: Allan ELKAIM

fs/squashfs: fix heap exhaustion during symlink resolution

2026-07-25T00:39:29Z

When sqfs_read_nest() encounters a symlink it resolves it by calling itself recursively. In the unfixed code this looks like: // dirsp is open: inode_table + dir_table still on heap resolved = sqfs_resolve_symlink(symlink, filename); ret = sqfs_read_nest(resolved, ...); // recursive: allocates a new // inode_table + dir_table pair free(resolved); goto out; // out: sqfs_closedir(dirsp) <- parent tables freed HERE, too late There is no permanent leak: the parent's tables are freed at the out: label once the recursive call returns. However, for the entire duration of the recursive call both the parent's inode_table + dir_table and the child's inode_table + dir_table are live on the heap simultaneously. On large squashfs images these tables can be significant in size, and this temporary double allocation may exhaust the heap budget. A superficial workaround would be to increase CONFIG_SYS_MALLOC_LEN, but that wastes memory on all boards and does not address the structural problem. The correct fix is to change the freeing order: release the parent directory's resources before recursing. This way only one set of inode and directory tables is live at any given time, halving the peak heap usage during symlink resolution. When heap exhaustion does occur and malloc returns NULL for dir_table or pos_list inside sqfs_read_directory_table(), the failure is currently silent and cascading: - metablks_count is not reset to -1 before the goto out, so the function returns a positive block count alongside a NULL pointer. - sqfs_opendir_nest() does not detect the failure (it only checks metablks_count < 1) and calls sqfs_search_dir() with m_list=NULL. - sqfs_dir_offset() iterates over m_list[0..n], reading from addresses 0x0, 0x4, 0x8, ... None of those values match the inode's start_block, so the function returns -EINVAL. - The error propagates up as a load failure with no indication that the root cause was heap exhaustion: Error: invalid inode reference to directory table. Failed to load '' Two fixes: 1. In sqfs_read_directory_table(), set metablks_count = -1 whenever malloc fails after sqfs_count_metablks() returns a positive value, so that the caller's "metablks_count < 1" check correctly detects the failure and avoids calling sqfs_search_dir() with a NULL pos_list. 2. In sqfs_read_nest() and sqfs_size_nest(), call sqfs_closedir() on the parent dirsp before the recursive call so that the parent's inode and directory tables are freed before the child allocates its own. Only one set of tables is then live at any given time, halving peak heap usage during symlink resolution. Link: https://lists.denx.de/pipermail/u-boot/2026-May/618533.html Reviewed-by: Richard Genoud Acked-by: Miquel Raynal Signed-off-by: Allan ELKAIM

fs/squashfs: Set ret to 0 on successful read

2026-04-24T17:28:10Z

It might still be a positive number due to the call to sqfs_disk_read. This only happens when reading a file from an uncompressed squashfs. I found this by trying to boot using the extlinux bootmethod, where positive values are treated as errors. Signed-off-by: Michael Zimmermann Acked-by: Richard Genoud Reviewed-by: Simon Glass

spl: add squashfs support

2026-03-26T17:04:28Z

Implement spl_load_image_sqfs() in spl code. This will be used in MMC to read a file from a squashfs partition. Also, loosen squashfs read checks on file size by not failing when a bigger size than the actual file size is requested. (Just read the file) This is needed for FIT loading, because the length is ALIGNed. Signed-off-by: Richard Genoud Reviewed-by: Miquel Raynal Reviewed-by: João Marcos Costa

fs/squashfs: sqfs_decompressor: simplify code

2026-03-26T17:04:28Z

Switch to if (CONFIG_IS_ENABLED()) instead of #if when possible and remove unnecessary cases. Signed-off-by: Richard Genoud Reviewed-by: Miquel Raynal Reviewed-by: João Marcos Costa

fs/squashfs: fix sqfs_decompressor.c build in SPL

2026-03-26T17:04:28Z

CONFIG_IS_ENABLED() must be used in place of IS_ENABLED() for config options that have a _SPL_ counterpart. Signed-off-by: Richard Genoud Reviewed-by: Miquel Raynal Reviewed-by: João Marcos Costa

fs/squashfs: fix heap buffer overflow in sqfs_frag_lookup()

2026-02-23T18:45:50Z

sqfs_frag_lookup() reads a 16-bit metadata block header whose lower 15 bits encode the data size. Unlike sqfs_read_metablock() in sqfs_inode.c, this function does not validate that the decoded size is within SQFS_METADATA_BLOCK_SIZE (8192). A malformed SquashFS image can set the size field to any value up to 32767, causing memcpy to write past the 8192-byte 'entries' heap buffer. Add the same bounds check used by sqfs_read_metablock(): reject any metadata block header with SQFS_METADATA_SIZE(header) exceeding SQFS_METADATA_BLOCK_SIZE. Found by fuzzing with libFuzzer + AddressSanitizer. Signed-off-by: Eric Kilmer Reviewed-by: Miquel Raynal

fs: prevent integer overflow in sqfs_concat

2026-01-16T19:04:40Z

An integer overflow in length calculation could lead to under-allocation and buffer overcopy. Signed-off-by: Timo tp Preißl Reviewed-by: Tom Rini Reviewed-by: Simon Glass Reviewed-by: João Marcos Costa