u-boot.git/fs/squashfs, branch next

spl: add squashfs support

2026-03-26T17:04:28+00:00

Implement spl_load_image_sqfs() in spl code.

This will be used in MMC to read a file from a squashfs partition.

Also, loosen squashfs read checks on file size by not failing when a
bigger size than the actual file size is requested. (Just read the file)
This is needed for FIT loading, because the length is ALIGNed.

Signed-off-by: Richard Genoud 
Reviewed-by: Miquel Raynal 
Reviewed-by: João Marcos Costa

fs/squashfs: sqfs_decompressor: simplify code

2026-03-26T17:04:28+00:00

Switch to if (CONFIG_IS_ENABLED()) instead of #if when possible and
remove unnecessary cases.

Signed-off-by: Richard Genoud 
Reviewed-by: Miquel Raynal 
Reviewed-by: João Marcos Costa

fs/squashfs: fix sqfs_decompressor.c build in SPL

2026-03-26T17:04:28+00:00

CONFIG_IS_ENABLED() must be used in place of IS_ENABLED() for config
options that have a _SPL_ counterpart.

Signed-off-by: Richard Genoud 
Reviewed-by: Miquel Raynal 
Reviewed-by: João Marcos Costa

fs/squashfs: fix heap buffer overflow in sqfs_frag_lookup()

2026-02-23T18:45:50+00:00

sqfs_frag_lookup() reads a 16-bit metadata block header whose lower
15 bits encode the data size. Unlike sqfs_read_metablock() in
sqfs_inode.c, this function does not validate that the decoded size is
within SQFS_METADATA_BLOCK_SIZE (8192). A malformed SquashFS image can
set the size field to any value up to 32767, causing memcpy to write
past the 8192-byte 'entries' heap buffer.

Add the same bounds check used by sqfs_read_metablock(): reject any
metadata block header with SQFS_METADATA_SIZE(header) exceeding
SQFS_METADATA_BLOCK_SIZE.

Found by fuzzing with libFuzzer + AddressSanitizer.

Signed-off-by: Eric Kilmer 
Reviewed-by: Miquel Raynal

fs: prevent integer overflow in sqfs_concat

2026-01-16T19:04:40+00:00

An integer overflow in length calculation could lead to
under-allocation and buffer overcopy.

Signed-off-by: Timo tp Preißl 
Reviewed-by: Tom Rini 
Reviewed-by: Simon Glass 
Reviewed-by: João Marcos Costa

fs/squashfs: Ensure memory is freed by using unwind goto

2025-10-10T20:27:49+00:00

Returning immediately from sqfs_read_nest is not consistent with other
error checks in this function and can lead to memory leaks. Instead use
the unwind goto used elsewhere to ensure that the memory is freed.

This issue was found by Smatch.

Signed-off-by: Andrew Goodbody 
Acked-by: Quentin Schulz 
Reviewed-by: Joao Marcos Costa

fs/squashfs: avoid illegal free() in sqfs_opendir()

2025-04-21T17:08:03+00:00

* Use calloc() to allocate token_list. This avoids an illegal free if
  sqfs_tokenize() fails.
* Do not iterate over token_list if it has not been allocated.

Addresses-Coverity-ID: 510453:  Null pointer dereferences  (FORWARD_NULL)
Signed-off-by: Heinrich Schuchardt 
Reviewed-by: Joao Marcos Costa 
Reviewed-by: Joao Marcos Costa

Kbuild: Always use $(PHASE_)

2025-04-11T18:16:44+00:00

It is confusing to have both "$(PHASE_)" and "$(XPL_)" be used in our
Makefiles as part of the macros to determine when to do something in our
Makefiles based on what phase of the build we are in. For consistency,
bring this down to a single macro and use "$(PHASE_)" only.

Signed-off-by: Tom Rini

fs/squashfs: Fix memory leak in sqfs_size_nest()

2025-03-05T18:14:31+00:00

In case MAX_SYMLINK_NEST is reached while determining the size
on a symlink node, the function returns immediately.
This would not free the resources after the free_strings: label
causing a memory leak.

Set the ret value and just break out of the switch to fix this.

Signed-off-by: Andrea della Porta 
Reviewed-by: Miquel Raynal

fs/squashfs: fix potential integer overflows

2025-02-24T14:49:04+00:00

The length of buffers used to read inode tables, directory tables, and
reading a file are calculated as: number of blocks * block size, and
such plain multiplication is prone to overflowing (thus unsafe).

Replace it by __builtin_mul_overflow, i.e. safe math.

Signed-off-by: Joao Marcos Costa