From 26c2901c7994bc260a97f2a7173d20499ef9e355 Mon Sep 17 00:00:00 2001 From: Phillip Lougher Date: Mon, 24 Nov 2025 09:53:09 +0800 Subject: [PATCH] Squashfs: reject negative file sizes in squashfs_read_inode() mainline inclusion from mainline-v6.17-rc4 commit 9f1c14c1de1bdde395f6cc893efa4f80a2ae3b2b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ID6BW5 CVE: CVE-2025-40200 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=9f1c14c1de1bdde395f6cc893efa4f80a2ae3b2b -------------------------------- Syskaller reports a "WARNING in ovl_copy_up_file" in overlayfs. This warning is ultimately caused because the underlying Squashfs file system returns a file with a negative file size. This commit checks for a negative file size and returns EINVAL. [phillip@squashfs.org.uk: only need to check 64 bit quantity] Link: https://lkml.kernel.org/r/20250926222305.110103-1-phillip@squashfs.org.uk Link: https://lkml.kernel.org/r/20250926215935.107233-1-phillip@squashfs.org.uk Fixes: 6545b246a2c8 ("Squashfs: inode operations") Signed-off-by: Phillip Lougher Reported-by: syzbot+f754e01116421e9754b9@syzkaller.appspotmail.com Closes: https://lore.kernel.org/all/68d580e5.a00a0220.303701.0019.GAE@google.com/ Cc: Amir Goldstein Cc: Signed-off-by: Andrew Morton Conflicts: fs/squashfs/inode.c [Context conflicts] Signed-off-by: Long Li --- fs/squashfs/inode.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/fs/squashfs/inode.c b/fs/squashfs/inode.c index 95a9ff9e2399..3cc84b5376a7 100644 --- a/fs/squashfs/inode.c +++ b/fs/squashfs/inode.c @@ -200,6 +200,10 @@ int squashfs_read_inode(struct inode *inode, long long ino) xattr_id = le32_to_cpu(sqsh_ino->xattr); set_nlink(inode, le32_to_cpu(sqsh_ino->nlink)); inode->i_size = le64_to_cpu(sqsh_ino->file_size); + if (inode->i_size < 0) { + err = -EINVAL; + goto failed_read; + } inode->i_op = &squashfs_inode_ops; inode->i_fop = &generic_ro_fops; inode->i_mode |= S_IFREG; -- Gitee