# git rev-parse -q --verify 01cfb7937a9af2abb1136c7e89fbf3fd92952956^{commit} 01cfb7937a9af2abb1136c7e89fbf3fd92952956 already have revision, skipping fetch # git checkout -q -f -B kisskb 01cfb7937a9af2abb1136c7e89fbf3fd92952956 # git clean -qxdf # < git log -1 # commit 01cfb7937a9af2abb1136c7e89fbf3fd92952956 # Author: Linus Torvalds # Date: Sun Jul 29 12:44:46 2018 -0700 # # squashfs: be more careful about metadata corruption # # Anatoly Trosinenko reports that a corrupted squashfs image can cause a # kernel oops. It turns out that squashfs can end up being confused about # negative fragment lengths. # # The regular squashfs_read_data() does check for negative lengths, but # squashfs_read_metadata() did not, and the fragment size code just # blindly trusted the on-disk value. Fix both the fragment parsing and # the metadata reading code. # # Reported-by: Anatoly Trosinenko # Cc: Al Viro # Cc: Phillip Lougher # Cc: stable@kernel.org # Signed-off-by: Linus Torvalds # < /opt/cross/kisskb/korg/gcc-8.1.0-nolibc/hppa-linux/bin/hppa-linux-gcc --version # < git log --format=%s --max-count=1 01cfb7937a9af2abb1136c7e89fbf3fd92952956 # < make -s -j 48 ARCH=parisc O=/kisskb/build/linus_parisc-defconfig_parisc CROSS_COMPILE=/opt/cross/kisskb/korg/gcc-8.1.0-nolibc/hppa-linux/bin/hppa-linux- defconfig # make -s -j 48 ARCH=parisc O=/kisskb/build/linus_parisc-defconfig_parisc CROSS_COMPILE=/opt/cross/kisskb/korg/gcc-8.1.0-nolibc/hppa-linux/bin/hppa-linux- :1335:2: warning: #warning syscall rseq not implemented [-Wcpp] In function 'kernfs_get_target_path', inlined from 'kernfs_getlink.isra.0' at /kisskb/src/fs/kernfs/symlink.c:109:10, inlined from 'kernfs_iop_get_link.part.1' at /kisskb/src/fs/kernfs/symlink.c:127:10, inlined from 'kernfs_iop_get_link': /kisskb/src/fs/kernfs/symlink.c:91:3: warning: 'strncpy' output truncated before terminating nul copying as many bytes from a string as its length [-Wstringop-truncation] strncpy(s + len, kn->name, slen); ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ /kisskb/src/fs/kernfs/symlink.c: In function 'kernfs_iop_get_link': /kisskb/src/fs/kernfs/symlink.c:88:14: note: length computed here int slen = strlen(kn->name); ^~~~~~~~~~~~~~~~ /kisskb/src/crypto/ablkcipher.c: In function 'crypto_ablkcipher_report': /kisskb/src/crypto/ablkcipher.c:374:2: warning: 'strncpy' specified bound 64 equals destination size [-Wstringop-truncation] strncpy(rblkcipher.geniv, alg->cra_ablkcipher.geniv ?: "", ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ sizeof(rblkcipher.geniv)); ~~~~~~~~~~~~~~~~~~~~~~~~~ /kisskb/src/crypto/ablkcipher.c: In function 'crypto_givcipher_report': /kisskb/src/crypto/ablkcipher.c:448:2: warning: 'strncpy' specified bound 64 equals destination size [-Wstringop-truncation] strncpy(rblkcipher.geniv, alg->cra_ablkcipher.geniv ?: "", ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ sizeof(rblkcipher.geniv)); ~~~~~~~~~~~~~~~~~~~~~~~~~ /kisskb/src/crypto/blkcipher.c: In function 'crypto_blkcipher_report': /kisskb/src/crypto/blkcipher.c:513:2: warning: 'strncpy' specified bound 64 equals destination size [-Wstringop-truncation] strncpy(rblkcipher.geniv, alg->cra_blkcipher.geniv ?: "", ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ sizeof(rblkcipher.geniv)); ~~~~~~~~~~~~~~~~~~~~~~~~~ /kisskb/src/fs/ext4/super.c: In function '__save_error_info.isra.5': /kisskb/src/fs/ext4/super.c:326:2: warning: 'strncpy' specified bound 32 equals destination size [-Wstringop-truncation] strncpy(es->s_last_error_func, func, sizeof(es->s_last_error_func)); ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ /kisskb/src/fs/ext4/super.c:330:3: warning: 'strncpy' specified bound 32 equals destination size [-Wstringop-truncation] strncpy(es->s_first_error_func, func, ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ sizeof(es->s_first_error_func)); ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ In function 'fill_kobj_path', inlined from 'kobject_get_path' at /kisskb/src/lib/kobject.c:155:2: /kisskb/src/lib/kobject.c:128:3: warning: 'strncpy' output truncated before terminating nul copying as many bytes from a string as its length [-Wstringop-truncation] strncpy(path + length, kobject_name(parent), cur); ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ /kisskb/src/lib/kobject.c: In function 'kobject_get_path': /kisskb/src/lib/kobject.c:125:13: note: length computed here int cur = strlen(kobject_name(parent)); ^~~~~~~~~~~~~~~~~~~~~~~~~~~~ Completed OK # rm -rf /kisskb/build/linus_parisc-defconfig_parisc # Build took: 0:01:15.505947