u-boot.git/fs/squashfs, branch v2023.01

Merge branch 'next'

2022-07-11T18:58:57Z

fs/squashfs: Use kcalloc when relevant

2022-06-28T19:51:56Z

A crafted squashfs image could embed a huge number of empty metadata blocks in order to make the amount of malloc()'d memory overflow and be much smaller than expected. Because of this flaw, any random code positioned at the right location in the squashfs image could be memcpy'd from the squashfs structures into U-Boot code location while trying to access the rearmost blocks, before being executed. In order to prevent this vulnerability from being exploited in eg. a secure boot environment, let's add a check over the amount of data that is going to be allocated. Such a check could look like: if (!elem_size || n > SIZE_MAX / elem_size) return NULL; The right way to do it would be to enhance the calloc() implementation but this is quite an impacting change for such a small fix. Another solution would be to add the check before the malloc call in the squashfs implementation, but this does not look right. So for now, let's use the kcalloc() compatibility function from Linux, which has this check. Fixes: c5100613037 ("fs/squashfs: new filesystem") Reported-by: Tatsuhiko Yasumatsu Signed-off-by: Miquel Raynal Tested-by: Tatsuhiko Yasumatsu

Merge branch 'master' into next

2022-06-20T18:40:59Z

Merge in v2022.07-rc5.

fs/squashfs: sqfs_read: Prevent arbitrary code execution

2022-06-16T19:22:55Z

Following Jincheng's report, an out-of-band write leading to arbitrary code execution is possible because on one side the squashfs logic accepts directory names up to 65535 bytes (u16), while U-Boot fs logic accepts directory names up to 255 bytes long. Prevent such an exploit from happening by capping directory name sizes to 255. Use a define for this purpose so that developers can link the limitation to its source and eventually kill it some day by dynamically allocating this array (if ever desired). Link: https://lore.kernel.org/all/CALO=DHFB+yBoXxVr5KcsK0iFdg+e7ywko4-e+72kjbcS8JBfPw@mail.gmail.com Reported-by: Jincheng Wang Signed-off-by: Miquel Raynal Tested-by: Jincheng Wang

fs/squashfs: fix sqfs_read_sblk()

2022-06-06T21:47:17Z

Setting sblk = NULL has no effect on the caller. We want to set *sblk = NULL if an error occurrs to avoid usage after free. Signed-off-by: Heinrich Schuchardt

squashfs: Fix compilation on big endian systems

2022-06-03T15:15:24Z

Signed-off-by: Pali Rohár Reviewed-by: Miquel Raynal

fs/squashfs: use lldiv function for math

2022-05-23T13:33:10Z

When compling for x86: ld.bfd: fs/squashfs/sqfs.o: in function `sqfs_read': u-boot/fs/squashfs/sqfs.c:1443: undefined reference to `__udivmoddi4' ld.bfd: u-boot/fs/squashfs/sqfs.c:1521: undefined reference to `__udivmoddi4' Signed-off-by: Sean Nyekjaer Reviewed-by: Miquel Raynal Reviewed-by: Pali Rohár

fs/squashfs: simplify sqfs_read()

2022-04-19T18:51:11Z

* Don't check argument of free(). Free does this itself. * Reduce scope of data_buffer. Remove duplicate free(). * Avoid superfluous NULL assignment. Signed-off-by: Heinrich Schuchardt Reviewed-by: Miquel Raynal

squashfs: show an error message if the inode_table can't be, allocated

2022-01-29T12:46:46Z

Signed-off-by: Lars Weber

sqfs: Suppress the message about missing filesystem

2021-09-16T17:19:25Z

This message comes up a lot when scanning filesystems. It suggests to the user that there is some sort of error, but in fact there is no reason to expect that a particular partition has a sqfs filesystem. Other filesystems don't print this error. Turn it into a debug message. Signed-off-by: Simon Glass Reviewed-by: Miquel Raynal