linux-kernel - [PATCH 2/3] squashfs: fix extending readahead beyond end of file

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 20 Oct 2022 23:36:15 +0100
From:   Phillip Lougher <phillip@...ashfs.org.uk>
To:     linux-kernel@...r.kernel.org, akpm@...ux-foundation.org
Cc:     hsinyi@...omium.org, regressions@...mhuis.info,
        regressions@...ts.linux.dev, dimitri.ledkov@...onical.com,
        michael.vogt@...onical.com, phillip.lougher@...il.com,
        ogra@...ntu.com, olivier.tilloy@...onical.com,
        Phillip Lougher <phillip@...ashfs.org.uk>,
        stable@...r.kernel.org
Subject: [PATCH 2/3] squashfs: fix extending readahead beyond end of file

The readahead code will try to extend readahead to the entire
size of the Squashfs data block.

But, it didn't take into account that the last block at the end of
the file may not be a whole block.  In this case, the code would
extend readahead to beyond the end of the file, leaving trailing
pages.

Fix this by only requesting the expected number of pages.

Fixes: 8fc78b6fe24c ("squashfs: implement readahead")
Signed-off-by: Phillip Lougher <phillip@...ashfs.org.uk>
Cc: <stable@...r.kernel.org>
---
 fs/squashfs/file.c | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

diff --git a/fs/squashfs/file.c b/fs/squashfs/file.c
index e526eb7a1658..f0afd4d6fd30 100644
--- a/fs/squashfs/file.c
+++ b/fs/squashfs/file.c
@@ -559,6 +559,12 @@ static void squashfs_readahead(struct readahead_control *ractl)
 		unsigned int expected;
 		struct page *last_page;
 
+		expected = start >> msblk->block_log == file_end ?
+			   (i_size_read(inode) & (msblk->block_size - 1)) :
+			    msblk->block_size;
+
+		max_pages = (expected + PAGE_SIZE - 1) >> PAGE_SHIFT;
+
 		nr_pages = __readahead_batch(ractl, pages, max_pages);
 		if (!nr_pages)
 			break;
@@ -567,13 +573,10 @@ static void squashfs_readahead(struct readahead_control *ractl)
 			goto skip_pages;
 
 		index = pages[0]->index >> shift;
+
 		if ((pages[nr_pages - 1]->index >> shift) != index)
 			goto skip_pages;
 
-		expected = index == file_end ?
-			   (i_size_read(inode) & (msblk->block_size - 1)) :
-			    msblk->block_size;
-
 		if (index == file_end && squashfs_i(inode)->fragment_block !=
 						SQUASHFS_INVALID_BLK) {
 			res = squashfs_readahead_fragment(pages, nr_pages,
-- 
2.35.1