Squashfs: handle corruption of directory structure
authorPhillip Lougher <phillip@lougher.demon.co.uk>
Tue, 15 Mar 2011 22:09:55 +0000 (22:09 +0000)
committerBrad Figg <brad.figg@canonical.com>
Wed, 27 Apr 2011 18:41:33 +0000 (11:41 -0700)
commita96873b4418a261d3998dfae6a3bbccb3f45d25b
tree726b2c5584acc40dc3d955459085db794e5a72cd
parent5dee1cf1757d005e467d4956a081c86a1f675a62
Squashfs: handle corruption of directory structure

BugLink: http://bugs.launchpad.net/bugs/761134

commit 44cff8a9ee8a974f9e931df910688e7fc1f0b0f9 upstream.

Handle the rare case where a directory metadata block is uncompressed and
corrupted, leading to a kernel oops in directory scanning (memcpy).
Normally corruption is detected at the decompression stage and dealt with
then, however, this will not happen if:

- metadata isn't compressed (users can optionally request no metadata
  compression), or
- the compressed metadata block was larger than the original, in which
  case the uncompressed version was used, or
- the data was corrupt after decompression

This patch fixes this by adding some sanity checks against known maximum
values.

Signed-off-by: Phillip Lougher <phillip@lougher.demon.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Tim Gardner <tim.gardner@canonical.com>
fs/squashfs/dir.c
fs/squashfs/namei.c