From bf48dde80a6c302b3279fe8ed1e5eb9e8fef4abd Mon Sep 17 00:00:00 2001 From: David Oberhollenzer Date: Sun, 25 Dec 2022 11:05:24 +0100 Subject: [PATCH] fs/squashfs: Only use export table if available For a squashfs filesystem, the fragment table is followed by the following tables: NFS export table, ID table, xattr table. The export and xattr tables are both completely optional, but the ID table is mandatory. The Linux implementation refuses to mount the image if the ID table is missing. Tables that are no present have their location in the super block set to 0xFFFFFFFFFFFFFFFF. The u-boot implementation previously assumed that it can always rely on the export table location as an upper bound for the fragment table, trying (and failing) to read past filesystem bounds if it is not present. This patch changes the driver to use the ID table instead and only use the export table location if it lies between the two. Signed-off-by: David Oberhollenzer Reviewed-by: Miquel Raynal --- fs/squashfs/sqfs.c | 16 +++++++++++----- 1 file changed, 11 insertions(+), 5 deletions(-) diff --git a/fs/squashfs/sqfs.c b/fs/squashfs/sqfs.c index 4226621923..1430e671a5 100644 --- a/fs/squashfs/sqfs.c +++ b/fs/squashfs/sqfs.c @@ -100,7 +100,7 @@ static int sqfs_calc_n_blks(__le64 start, __le64 end, u64 *offset) static int sqfs_frag_lookup(u32 inode_fragment_index, struct squashfs_fragment_block_entry *e) { - u64 start, n_blks, src_len, table_offset, start_block; + u64 start, end, exp_tbl, n_blks, src_len, table_offset, start_block; unsigned char *metadata_buffer, *metadata, *table; struct squashfs_fragment_block_entry *entries; struct squashfs_super_block *sblk = ctxt.sblk; @@ -115,11 +115,17 @@ static int sqfs_frag_lookup(u32 inode_fragment_index, if (inode_fragment_index >= get_unaligned_le32(&sblk->fragments)) return -EINVAL; - start = get_unaligned_le64(&sblk->fragment_table_start) / - ctxt.cur_dev->blksz; + start = get_unaligned_le64(&sblk->fragment_table_start); + end = get_unaligned_le64(&sblk->id_table_start); + exp_tbl = get_unaligned_le64(&sblk->export_table_start); + + if (exp_tbl > start && exp_tbl < end) + end = exp_tbl; + n_blks = sqfs_calc_n_blks(sblk->fragment_table_start, - sblk->export_table_start, - &table_offset); + cpu_to_le64(end), &table_offset); + + start /= ctxt.cur_dev->blksz; /* Allocate a proper sized buffer to store the fragment index table */ table = malloc_cache_aligned(n_blks * ctxt.cur_dev->blksz); -- 2.39.5