Re: [PATCH] Squashfs: check block offset is not negative
Andrew Morton <[email protected]>
| Newsgroups | org.kernel.vger.linux-kernel |
|---|---|
| Message-ID | <[email protected]> |
On Tue, 4 Aug 2026 20:40:37 +0100 Phillip Lougher <[email protected]> wrote: > If a negative offset is read off disk (for example the offset into the > decompressed fragment block), this will cause squashfs_copy_data() to > perform an out of bounds access. > > Fix by checking if offset is negative, and returning 0. This matches > existing behaviour where an offset beyond the block returns 0 bytes > copied. > > Fixes: f400e12656ab ("Squashfs: cache operations") I agree with your removal of cc:stable. "crafted image requires CAP_SYS_ADMIN" isn't a thing we should bother backporting. It's worth mentioning this in the changelog - let's please develop the habit of describing the userspace-visible impact of bugs when we fix them.