u-boot.git/fs/squashfs, branch v2025.04

fs/squashfs: Fix memory leak in sqfs_size_nest()

2025-03-05T18:14:31Z

In case MAX_SYMLINK_NEST is reached while determining the size on a symlink node, the function returns immediately. This would not free the resources after the free_strings: label causing a memory leak. Set the ret value and just break out of the switch to fix this. Signed-off-by: Andrea della Porta Reviewed-by: Miquel Raynal

fs/squashfs: fix potential integer overflows

2025-02-24T14:49:04Z

The length of buffers used to read inode tables, directory tables, and reading a file are calculated as: number of blocks * block size, and such plain multiplication is prone to overflowing (thus unsafe). Replace it by __builtin_mul_overflow, i.e. safe math. Signed-off-by: Joao Marcos Costa

squashfs: Fix sqfs_inode_size() for xattr related SQFS_LSYMLINK_TYPE

2025-01-18T14:29:10Z

A squashfs filesystem with extended attributes (xattrs) may have inodes of type SQFS_LSYMLINK_TYPE. This might cause u-boot to fail to handle the filesystem since it assumes a SYMLINK_TYPE and LSYMLINK_TYPE inode are the same size. This is wrong, see: https://github.com/plougher/squashfs-tools/blob/master/squashfs-tools/read_fs.c#L421 Using the mksquashfs '-no-xattrs' argument is probably best, but the mksquashfs '-xattrs' argument is the default. This patch fixes squashfs image handling by making sure parsing the uncompressed inode_table (with sqfs_find_inode) succeeeds. The only change needed is correctly determining the size of a SQFS_LSYMLINK_TYPE inode. Signed-off-by: Norbert van Bolhuis

global: Rename SPL_ to XPL_

2024-10-11T17:44:48Z

Use XPL_ as the symbol to indicate an SPL build. This means that SPL_ is no-longer set. Signed-off-by: Simon Glass

squashfs: Fix heap corruption in sqfs_search_dir()

2024-08-15T22:14:36Z

res needs to be large enough to store both strings rem and target, plus the path separator and the terminator. Currently the space for the path separator is not accounted, so the heap is corrupted by one byte. Signed-off-by: Richard Weinberger Reviewed-by: Miquel Raynal

squashfs: Fix stack overflow while symlink resolving

2024-08-15T22:14:36Z

The squashfs driver blindly follows symlinks, and calls sqfs_size() recursively. So an attacker can create a crafted filesystem and with a deep enough nesting level a stack overflow can be achieved. Fix by limiting the nesting level to 8. Signed-off-by: Richard Weinberger Reviewed-by: Miquel Raynal

squashfs: Check sqfs_find_inode() return value

2024-08-15T22:14:36Z

The function can fail and return NULL. Signed-off-by: Richard Weinberger Reviewed-by: Miquel Raynal

squashfs: Fix integer overflow in sqfs_inode_size()

2024-08-15T22:14:36Z

A carefully crafted squashfs filesystem can exhibit an extremly large inode size and overflow the calculation in sqfs_inode_size(). As a consequence, the squashfs driver will read from wrong locations. Fix by using __builtin_add_overflow() to detect the overflow. Signed-off-by: Richard Weinberger Reviewed-by: Miquel Raynal

squashfs: Fix integer overflow in sqfs_resolve_symlink()

2024-08-15T22:14:36Z

A carefully crafted squashfs filesystem can exhibit an inode size of 0xffffffff, as a consequence malloc() will do a zero allocation. Later in the function the inode size is again used for copying data. So an attacker can overwrite memory. Avoid the overflow by using the __builtin_add_overflow() helper. Signed-off-by: Richard Weinberger Reviewed-by: Miquel Raynal

fs/squashfs: enable LZ4 compression support

2023-11-16T23:53:09Z

The structure is identical to the existing compressor implementations, trivially adding lz4 decompression to sqfs_decompress. The changes were tested using a sandbox build. An LZ4 compressed squashfs image was bound as a host block device. Signed-off-by: David Oberhollenzer Reviewed-by: Joao Marcos Costa