u-boot.git/fs/squashfs, branch v2023.04

lib: zstd: update to latest Linux zstd 1.5.2

2023-01-19T00:04:17Z

Update the zstd implementation to match Linux zstd 1.5.2 from commit 2aa14b1ab2. This was motivated by running into decompression corruption issues when trying to uncompress files compressed with newer versions of zstd. zstd users also claim significantly improved decompression times with newer zstd versions which is a side benefit. Original zstd code was copied from Linux commit 2aa14b1ab2 which is a custom-built implementation based on zstd 1.3.1. Linux switched to an implementation that is a copy of the upstream zstd code in Linux commit e0c1b49f5b, this results in a large code diff. However this should make future updates easier along with other benefits[1]. This commit is a straight mirror of the Linux zstd code, except to: - update a few #include that do not translate cleanly - linux/swab.h -> asm/byteorder.h - linux/limits.h -> linux/kernel.h - linux/module.h -> linux/compat.h - remove assert() from debug.h so it doesn't conflict with u-boot's assert() - strip out the compressor code as was done in the previous u-boot zstd - update existing zstd users to the new Linux zstd API - change the #define for MEM_STATIC to use INLINE_KEYWORD for codesize - add a new KConfig option that sets zstd build options to minify code based on zstd's ZSTD_LIB_MINIFY[2]. These changes were tested by booting a zstd 1.5.2 compressed kernel inside a FIT. And the squashfs changes by loading a file from zstd compressed squashfs with sqfsload. buildman was used to compile test other boards and check for binary bloat, as follows: > $ buildman -b zstd2 --boards dh_imx6,m53menlo,mvebu_espressobin-88f3720,sandbox,sandbox64,stm32mp15_dhcom_basic,stm32mp15_dhcor_basic,turris_mox,turris_omnia -sS > Summary of 6 commits for 9 boards (8 threads, 1 job per thread) > 01: Merge branch '2023-01-10-platform-updates' > arm: w+ m53menlo dh_imx6 > 02: lib: zstd: update to latest Linux zstd 1.5.2 > aarch64: (for 2/2 boards) all -3186.0 rodata +920.0 text -4106.0 > arm: (for 5/5 boards) all +1254.4 rodata +940.0 text +314.4 > sandbox: (for 2/2 boards) all -4452.0 data -16.0 rodata +640.0 text -5076.0 [1] https://github.com/torvalds/linux/commit/e0c1b49f5b674cca7b10549c53b3791d0bbc90a8 [2] https://github.com/facebook/zstd/blob/f302ad8811643c428c4e3498e28f53a0578020d3/lib/libzstd.mk#L31 Signed-off-by: Brandon Maier [trini: Set ret to -EINVAL for the error of "failed to detect compressed" to fix warning, drop ZSTD_SRCSIZEHINT_MAX for non-Linux host tool builds] Signed-off-by: Tom Rini

fs/squashfs: Only use export table if available

2023-01-11T20:02:24Z

For a squashfs filesystem, the fragment table is followed by the following tables: NFS export table, ID table, xattr table. The export and xattr tables are both completely optional, but the ID table is mandatory. The Linux implementation refuses to mount the image if the ID table is missing. Tables that are no present have their location in the super block set to 0xFFFFFFFFFFFFFFFF. The u-boot implementation previously assumed that it can always rely on the export table location as an upper bound for the fragment table, trying (and failing) to read past filesystem bounds if it is not present. This patch changes the driver to use the ID table instead and only use the export table location if it lies between the two. Signed-off-by: David Oberhollenzer Reviewed-by: Miquel Raynal

fs/squashfs: use lldiv function for math

2022-12-08T14:29:02Z

When compling for x86: u-boot/fs/squashfs/sqfs.c:90: undefined reference to `__udivmoddi4' Signed-off-by: Kasper Revsbech Tested-by: Sean Nyekjaer

Merge branch 'next'

2022-07-11T18:58:57Z

fs/squashfs: Use kcalloc when relevant

2022-06-28T19:51:56Z

A crafted squashfs image could embed a huge number of empty metadata blocks in order to make the amount of malloc()'d memory overflow and be much smaller than expected. Because of this flaw, any random code positioned at the right location in the squashfs image could be memcpy'd from the squashfs structures into U-Boot code location while trying to access the rearmost blocks, before being executed. In order to prevent this vulnerability from being exploited in eg. a secure boot environment, let's add a check over the amount of data that is going to be allocated. Such a check could look like: if (!elem_size || n > SIZE_MAX / elem_size) return NULL; The right way to do it would be to enhance the calloc() implementation but this is quite an impacting change for such a small fix. Another solution would be to add the check before the malloc call in the squashfs implementation, but this does not look right. So for now, let's use the kcalloc() compatibility function from Linux, which has this check. Fixes: c5100613037 ("fs/squashfs: new filesystem") Reported-by: Tatsuhiko Yasumatsu Signed-off-by: Miquel Raynal Tested-by: Tatsuhiko Yasumatsu

Merge branch 'master' into next

2022-06-20T18:40:59Z

Merge in v2022.07-rc5.

fs/squashfs: sqfs_read: Prevent arbitrary code execution

2022-06-16T19:22:55Z

Following Jincheng's report, an out-of-band write leading to arbitrary code execution is possible because on one side the squashfs logic accepts directory names up to 65535 bytes (u16), while U-Boot fs logic accepts directory names up to 255 bytes long. Prevent such an exploit from happening by capping directory name sizes to 255. Use a define for this purpose so that developers can link the limitation to its source and eventually kill it some day by dynamically allocating this array (if ever desired). Link: https://lore.kernel.org/all/CALO=DHFB+yBoXxVr5KcsK0iFdg+e7ywko4-e+72kjbcS8JBfPw@mail.gmail.com Reported-by: Jincheng Wang Signed-off-by: Miquel Raynal Tested-by: Jincheng Wang

fs/squashfs: fix sqfs_read_sblk()

2022-06-06T21:47:17Z

Setting sblk = NULL has no effect on the caller. We want to set *sblk = NULL if an error occurrs to avoid usage after free. Signed-off-by: Heinrich Schuchardt

squashfs: Fix compilation on big endian systems

2022-06-03T15:15:24Z

Signed-off-by: Pali Rohár Reviewed-by: Miquel Raynal

fs/squashfs: use lldiv function for math

2022-05-23T13:33:10Z

When compling for x86: ld.bfd: fs/squashfs/sqfs.o: in function `sqfs_read': u-boot/fs/squashfs/sqfs.c:1443: undefined reference to `__udivmoddi4' ld.bfd: u-boot/fs/squashfs/sqfs.c:1521: undefined reference to `__udivmoddi4' Signed-off-by: Sean Nyekjaer Reviewed-by: Miquel Raynal Reviewed-by: Pali Rohár