Re: [PATCH v2] Squashfs: check block offset is not negative

Hi,

On Wed, Aug 05, 2026 at 06:48:22PM -0700, Andrew Morton wrote:
> > >> To trigger this out of bounds access requires a crafted Squashfs
> > >> filesystem and CAP_SYS_ADMIN to mount it.  Unprivileged users will not
> > >> be able to mount such a filesystem, but once mounted, an unprivileged
> > >> user can trigger the out of bounds access by reading the crafted file
> > >> with the negative offset.
> > > 
> > > AI review thinks we might have an information leak in there:
> > > 	https://sashiko.dev/#/patchset/[email protected]
> > 
> > Having done some more research, it looks like the AI is using an OLD kernel version
> > dating back to before 2018-08-01.
> 
> Thanks for looking into this.
> 
> I'd be surprised if this was the case, but what would I know?  Perhaps
> Sashiko trained itself on a seven year old kernel?
> 

There really isn't any training happening within Sashiko itself. Unless you
count the guidance/instructions located within the prompts (which are sync'd and
modified from Chris Mason's repo).

It's more likely that an incorrect baseline is being applied (noted in the
followup emails from Phillip in this thread).

> 
> I've been wondering about this.  What kernel versions does Sashiko
> attempt, and why?
> 
> I was recently surprised to see some MM report against the net/next
> branch!  I assume it found the patchset applied so off it went.
> 
> Can sashiko peeps please clarify?  What is the algorithm for trial
> applications?  What trees/branches does it attempt and in what order?
> 

src/baseline.rs are where baselines are defined, it is selected from
base commits, patch subject line, MAINTAINERS file, etc. There is a hardcoded
linux-next in there that the logic can "select" from, so to speak.

-- 
Derek <[email protected]>