u-boot.git/fs/squashfs, branch v2026.04

fs/squashfs: fix heap buffer overflow in sqfs_frag_lookup()

2026-02-23T18:45:50Z

sqfs_frag_lookup() reads a 16-bit metadata block header whose lower 15 bits encode the data size. Unlike sqfs_read_metablock() in sqfs_inode.c, this function does not validate that the decoded size is within SQFS_METADATA_BLOCK_SIZE (8192). A malformed SquashFS image can set the size field to any value up to 32767, causing memcpy to write past the 8192-byte 'entries' heap buffer. Add the same bounds check used by sqfs_read_metablock(): reject any metadata block header with SQFS_METADATA_SIZE(header) exceeding SQFS_METADATA_BLOCK_SIZE. Found by fuzzing with libFuzzer + AddressSanitizer. Signed-off-by: Eric Kilmer Reviewed-by: Miquel Raynal

fs: prevent integer overflow in sqfs_concat

2026-01-16T19:04:40Z

An integer overflow in length calculation could lead to under-allocation and buffer overcopy. Signed-off-by: Timo tp Preißl Reviewed-by: Tom Rini Reviewed-by: Simon Glass Reviewed-by: João Marcos Costa

fs/squashfs: Ensure memory is freed by using unwind goto

2025-10-10T20:27:49Z

Returning immediately from sqfs_read_nest is not consistent with other error checks in this function and can lead to memory leaks. Instead use the unwind goto used elsewhere to ensure that the memory is freed. This issue was found by Smatch. Signed-off-by: Andrew Goodbody Acked-by: Quentin Schulz Reviewed-by: Joao Marcos Costa

fs/squashfs: avoid illegal free() in sqfs_opendir()

2025-04-21T17:08:03Z

* Use calloc() to allocate token_list. This avoids an illegal free if sqfs_tokenize() fails. * Do not iterate over token_list if it has not been allocated. Addresses-Coverity-ID: 510453: Null pointer dereferences (FORWARD_NULL) Signed-off-by: Heinrich Schuchardt Reviewed-by: Joao Marcos Costa Reviewed-by: Joao Marcos Costa

Kbuild: Always use $(PHASE_)

2025-04-11T18:16:44Z

It is confusing to have both "$(PHASE_)" and "$(XPL_)" be used in our Makefiles as part of the macros to determine when to do something in our Makefiles based on what phase of the build we are in. For consistency, bring this down to a single macro and use "$(PHASE_)" only. Signed-off-by: Tom Rini

fs/squashfs: Fix memory leak in sqfs_size_nest()

2025-03-05T18:14:31Z

In case MAX_SYMLINK_NEST is reached while determining the size on a symlink node, the function returns immediately. This would not free the resources after the free_strings: label causing a memory leak. Set the ret value and just break out of the switch to fix this. Signed-off-by: Andrea della Porta Reviewed-by: Miquel Raynal

fs/squashfs: fix potential integer overflows

2025-02-24T14:49:04Z

The length of buffers used to read inode tables, directory tables, and reading a file are calculated as: number of blocks * block size, and such plain multiplication is prone to overflowing (thus unsafe). Replace it by __builtin_mul_overflow, i.e. safe math. Signed-off-by: Joao Marcos Costa

squashfs: Fix sqfs_inode_size() for xattr related SQFS_LSYMLINK_TYPE

2025-01-18T14:29:10Z

A squashfs filesystem with extended attributes (xattrs) may have inodes of type SQFS_LSYMLINK_TYPE. This might cause u-boot to fail to handle the filesystem since it assumes a SYMLINK_TYPE and LSYMLINK_TYPE inode are the same size. This is wrong, see: https://github.com/plougher/squashfs-tools/blob/master/squashfs-tools/read_fs.c#L421 Using the mksquashfs '-no-xattrs' argument is probably best, but the mksquashfs '-xattrs' argument is the default. This patch fixes squashfs image handling by making sure parsing the uncompressed inode_table (with sqfs_find_inode) succeeeds. The only change needed is correctly determining the size of a SQFS_LSYMLINK_TYPE inode. Signed-off-by: Norbert van Bolhuis

global: Rename SPL_ to XPL_

2024-10-11T17:44:48Z

Use XPL_ as the symbol to indicate an SPL build. This means that SPL_ is no-longer set. Signed-off-by: Simon Glass

squashfs: Fix heap corruption in sqfs_search_dir()

2024-08-15T22:14:36Z

res needs to be large enough to store both strings rem and target, plus the path separator and the terminator. Currently the space for the path separator is not accounted, so the heap is corrupted by one byte. Signed-off-by: Richard Weinberger Reviewed-by: Miquel Raynal