Re: [PATCH v2] Squashfs: check block offset is not negative

(cc sashiko@, I trust that's OK)

On Wed, 5 Aug 2026 23:29:27 +0100 Phillip Lougher <[email protected]> wrote:

> 
> 
> On 05/08/2026 19:15, Andrew Morton wrote:
> > On Wed,  5 Aug 2026 18:59:00 +0100 Phillip Lougher <[email protected]> wrote:
> > 
> >> If a negative offset is read off disk (for example the offset into the
> >> decompressed fragment block), this will cause squashfs_copy_data() to
> >> perform an out of bounds access.
> >>
> >> Fix by checking if offset is negative, and returning 0.  This matches
> >> existing behaviour where an offset beyond the block returns 0 bytes
> >> copied.
> >>
> >> To trigger this out of bounds access requires a crafted Squashfs
> >> filesystem and CAP_SYS_ADMIN to mount it.  Unprivileged users will not
> >> be able to mount such a filesystem, but once mounted, an unprivileged
> >> user can trigger the out of bounds access by reading the crafted file
> >> with the negative offset.
> > 
> > AI review thinks we might have an information leak in there:
> > 	https://sashiko.dev/#/patchset/[email protected]
> 
> Having done some more research, it looks like the AI is using an OLD kernel version
> dating back to before 2018-08-01.

Thanks for looking into this.

I'd be surprised if this was the case, but what would I know?  Perhaps
Sashiko trained itself on a seven year old kernel?

> The code in question was changed by Linus Torvalds on 2018-08-01 with this commit
> 
> https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=cdbb65c4c7ead680ebe54f4f0d486e2847a500ea
> 
> Specifically, that commit changed the following lines from:
> 
> 
> -		squashfs_copy_data(pageaddr, buffer, offset, avail);
> -		memset(pageaddr + avail, 0, PAGE_SIZE - avail);
> 
> to
> 
> +	copied = squashfs_copy_data(pageaddr, buffer, offset, avail);
> +	memset(pageaddr + copied, 0, PAGE_SIZE - copied);
> 
> So the issue the AI is complaining about no longer exists.

I've been wondering about this.  What kernel versions does Sashiko
attempt, and why?

I was recently surprised to see some MM report against the net/next
branch!  I assume it found the patchset applied so off it went.

Can sashiko peeps please clarify?  What is the algorithm for trial
applications?  What trees/branches does it attempt and in what order?