Re: [PATCH v2] Squashfs: check block offset is not negative

Hi,

Thanks for the report :)

On Thu, Aug 06, 2026 at 05:10:12PM +0100, Phillip Lougher wrote:
> > > > 
> > > > AI review thinks we might have an information leak in there:
> > > > 	https://sashiko.dev/#/patchset/[email protected]
> > > 
> > > Having done some more research, it looks like the AI is using an OLD kernel version
> > > dating back to before 2018-08-01.
> > 
> > Thanks for looking into this.
> > 
> > I'd be surprised if this was the case, but what would I know?  Perhaps
> > Sashiko trained itself on a seven year old kernel?
> 
> The solution to the mystery is to look at the Sashiko output, to
> see where they got the kernel.
> 
> *********************
> Selected:
> squashfs-next/HEAD / 62421645
> *********************
> 
> So the kernel they used is my squashfs-next tree.
> 
> There are three problems with that.
> 
> 1. I have not updated the squashfs-next tree in at
>    least twelve years (2014 would have been the latest).
> 
> 2. I lost access to git.kernel.org in about 2015.
> 
> 3. Having had a look on git.kernel.org, the squashfs-next tree doesn't
>    seem to exist anymore anyway (purged due to disuse?)
> 
> So the fix here for Sashiko is to use the latest kernel tree, and not an
> ancient squashfs-next tree which doesn't exist anymore.
> 
> Phillip
> 
> 
> 

Yes. It seems like Sashiko is selecting the incorrect baseline here. However,
from what I can see in baseline.rs, Sashiko pulls the mainline MAINTAINERS entry
and parses it to find whatever "matched" subsystem it could detect from the
patches.

From Torvald's tree (remote:
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git) with HEAD at
fcaeecb8b0cd44f77d03b28de0671258d4db18f8

SQUASHFS FILE SYSTEM
M:	Phillip Lougher <[email protected]>
L:	[email protected] (subscribers-only)
S:	Maintained
W:	http://squashfs.org.uk
T:	git git://git.kernel.org/pub/scm/linux/kernel/git/pkl/squashfs-next.git
F:	Documentation/filesystems/squashfs.rst
F:	fs/squashfs/

I may be mistaken, but maybe updating the "T:" entry would resolve the issues
you are seeing? Is this the same tree that you described as "purged"/unused?


Thanks,

-- 
Derek <[email protected]>