<feed xmlns='http://www.w3.org/2005/Atom'>
<title>linux-toradex.git/fs/squashfs/dir.c, branch v4.4.23</title>
<subtitle>Linux kernel for Apalis and Colibri modules</subtitle>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/'/>
<entry>
<title>Squashfs: add corruption check for type in squashfs_readdir()</title>
<updated>2013-09-06T03:57:54+00:00</updated>
<author>
<name>Phillip Lougher</name>
<email>phillip@squashfs.org.uk</email>
</author>
<published>2013-09-04T01:58:12+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=9e012423869e1efbae3762b87ceab509027231c9'/>
<id>9e012423869e1efbae3762b87ceab509027231c9</id>
<content type='text'>
We read the type field from disk.  This value should be sanity
checked for correctness to avoid an out of bounds access when
reading the squashfs_filetype_table array.

Signed-off-by: Phillip Lougher &lt;phillip@squashfs.org.uk&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
We read the type field from disk.  This value should be sanity
checked for correctness to avoid an out of bounds access when
reading the squashfs_filetype_table array.

Signed-off-by: Phillip Lougher &lt;phillip@squashfs.org.uk&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>Squashfs: add corruption check in get_dir_index_using_offset()</title>
<updated>2013-09-06T03:57:53+00:00</updated>
<author>
<name>Phillip Lougher</name>
<email>phillip@squashfs.org.uk</email>
</author>
<published>2013-09-03T03:52:52+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=f960cae5357d8e52b8af91e8b1621cae565dffb3'/>
<id>f960cae5357d8e52b8af91e8b1621cae565dffb3</id>
<content type='text'>
We read the size (of the name) field from disk.  This value should
be sanity checked for correctness to avoid blindly reading
huge amounts of unnecessary data from disk on corruption.

Note, here we're not actually reading the name into a buffer, but
skipping it, and so corruption doesn't cause buffer overflow, merely
lots of unnecessary amounts of data to be read.

Signed-off-by: Phillip Lougher &lt;phillip@squashfs.org.uk&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
We read the size (of the name) field from disk.  This value should
be sanity checked for correctness to avoid blindly reading
huge amounts of unnecessary data from disk on corruption.

Note, here we're not actually reading the name into a buffer, but
skipping it, and so corruption doesn't cause buffer overflow, merely
lots of unnecessary amounts of data to be read.

Signed-off-by: Phillip Lougher &lt;phillip@squashfs.org.uk&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>Squashfs: fix corruption checks in squashfs_readdir()</title>
<updated>2013-09-06T03:57:53+00:00</updated>
<author>
<name>Phillip Lougher</name>
<email>phillip@squashfs.org.uk</email>
</author>
<published>2013-09-03T03:38:43+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=68e7f412370ecfeb1bd667d0d174fad34517516e'/>
<id>68e7f412370ecfeb1bd667d0d174fad34517516e</id>
<content type='text'>
The dir_count and size fields when read from disk are sanity
checked for correctness.  However, the sanity checks only check the
values are not greater than expected.  As dir_count and size were
incorrectly defined as signed ints, this can lead to corrupted values
appearing as negative which are not trapped.

Signed-off-by: Phillip Lougher &lt;phillip@squashfs.org.uk&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
The dir_count and size fields when read from disk are sanity
checked for correctness.  However, the sanity checks only check the
values are not greater than expected.  As dir_count and size were
incorrectly defined as signed ints, this can lead to corrupted values
appearing as negative which are not trapped.

Signed-off-by: Phillip Lougher &lt;phillip@squashfs.org.uk&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>[readdir] convert squashfs</title>
<updated>2013-06-29T08:56:28+00:00</updated>
<author>
<name>Al Viro</name>
<email>viro@zeniv.linux.org.uk</email>
</author>
<published>2013-05-16T05:17:58+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=5f6039ce69605e40e9188437d8837a67f8056ec6'/>
<id>5f6039ce69605e40e9188437d8837a67f8056ec6</id>
<content type='text'>
Signed-off-by: Al Viro &lt;viro@zeniv.linux.org.uk&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
Signed-off-by: Al Viro &lt;viro@zeniv.linux.org.uk&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>new helper: file_inode(file)</title>
<updated>2013-02-23T04:31:31+00:00</updated>
<author>
<name>Al Viro</name>
<email>viro@zeniv.linux.org.uk</email>
</author>
<published>2013-01-23T22:07:38+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=496ad9aa8ef448058e36ca7a787c61f2e63f0f54'/>
<id>496ad9aa8ef448058e36ca7a787c61f2e63f0f54</id>
<content type='text'>
Signed-off-by: Al Viro &lt;viro@zeniv.linux.org.uk&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
Signed-off-by: Al Viro &lt;viro@zeniv.linux.org.uk&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>Squashfs: fix f_pos check in get_dir_index_using_offset</title>
<updated>2012-03-10T03:01:02+00:00</updated>
<author>
<name>Phillip Lougher</name>
<email>phillip@squashfs.org.uk</email>
</author>
<published>2012-03-09T02:27:49+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=2158d3fd2769546cd9004eaeb776fee946155238'/>
<id>2158d3fd2769546cd9004eaeb776fee946155238</id>
<content type='text'>
One off error in the f_pos check.  If f_pos is 3 or less don't
bother reading the index because we're at the start of the
directory, and we obviously already know where that is on disk.

This eliminates an unnecessary read.

Signed-off-by: Phillip Lougher &lt;phillip@squashfs.org.uk&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
One off error in the f_pos check.  If f_pos is 3 or less don't
bother reading the index because we're at the start of the
directory, and we obviously already know where that is on disk.

This eliminates an unnecessary read.

Signed-off-by: Phillip Lougher &lt;phillip@squashfs.org.uk&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>Squashfs: remove redundant length initialisation in squashfs_readdir</title>
<updated>2012-03-10T03:01:01+00:00</updated>
<author>
<name>Phillip Lougher</name>
<email>phillip@squashfs.org.uk</email>
</author>
<published>2012-03-06T23:02:49+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=68a8c397bf1bc16640e87d229025ffd4e4b54e6c'/>
<id>68a8c397bf1bc16640e87d229025ffd4e4b54e6c</id>
<content type='text'>
Signed-off-by: Phillip Lougher &lt;phillip@squashfs.org.uk&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
Signed-off-by: Phillip Lougher &lt;phillip@squashfs.org.uk&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>Squashfs: use define instead of constant</title>
<updated>2012-03-10T03:00:54+00:00</updated>
<author>
<name>Ajeet Yadav</name>
<email>ajeet.yadav.77@gmail.com</email>
</author>
<published>2012-02-02T07:34:49+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=4826d83d9c4f6bbf61f997e7b68547b4bffd8a49'/>
<id>4826d83d9c4f6bbf61f997e7b68547b4bffd8a49</id>
<content type='text'>
Its better to use defined name instead of constant

Signed-off-by: Ajeet Yadav &lt;ajeet.yadav.77@gmail.com&gt;
Signed-off-by: Phillip Lougher &lt;phillip@squashfs.org.uk&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
Its better to use defined name instead of constant

Signed-off-by: Ajeet Yadav &lt;ajeet.yadav.77@gmail.com&gt;
Signed-off-by: Phillip Lougher &lt;phillip@squashfs.org.uk&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>Squashfs: update email address</title>
<updated>2011-05-26T09:49:11+00:00</updated>
<author>
<name>Phillip Lougher</name>
<email>phillip@lougher.demon.co.uk</email>
</author>
<published>2011-05-26T09:39:56+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=d7f2ff6718efa155fd92e481a5960496d084c63f'/>
<id>d7f2ff6718efa155fd92e481a5960496d084c63f</id>
<content type='text'>
My existing email address may stop working in a month or two, so update
email to one that will continue working.

Signed-off-by: Phillip Lougher &lt;phillip@lougher.demon.co.uk&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
My existing email address may stop working in a month or two, so update
email to one that will continue working.

Signed-off-by: Phillip Lougher &lt;phillip@lougher.demon.co.uk&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>Squashfs: handle corruption of directory structure</title>
<updated>2011-03-16T01:04:18+00:00</updated>
<author>
<name>Phillip Lougher</name>
<email>phillip@lougher.demon.co.uk</email>
</author>
<published>2011-03-15T22:09:55+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=44cff8a9ee8a974f9e931df910688e7fc1f0b0f9'/>
<id>44cff8a9ee8a974f9e931df910688e7fc1f0b0f9</id>
<content type='text'>
Handle the rare case where a directory metadata block is uncompressed and
corrupted, leading to a kernel oops in directory scanning (memcpy).
Normally corruption is detected at the decompression stage and dealt with
then, however, this will not happen if:

- metadata isn't compressed (users can optionally request no metadata
  compression), or
- the compressed metadata block was larger than the original, in which
  case the uncompressed version was used, or
- the data was corrupt after decompression

This patch fixes this by adding some sanity checks against known maximum
values.

Signed-off-by: Phillip Lougher &lt;phillip@lougher.demon.co.uk&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
Handle the rare case where a directory metadata block is uncompressed and
corrupted, leading to a kernel oops in directory scanning (memcpy).
Normally corruption is detected at the decompression stage and dealt with
then, however, this will not happen if:

- metadata isn't compressed (users can optionally request no metadata
  compression), or
- the compressed metadata block was larger than the original, in which
  case the uncompressed version was used, or
- the data was corrupt after decompression

This patch fixes this by adding some sanity checks against known maximum
values.

Signed-off-by: Phillip Lougher &lt;phillip@lougher.demon.co.uk&gt;
</pre>
</div>
</content>
</entry>
</feed>
