Merge git://git.kernel.org/pub/scm/linux/kernel/git/pkl/squashfs-linus

* git://git.kernel.org/pub/scm/linux/kernel/git/pkl/squashfs-linus:
  Squashfs: frag_size should be signed, as it can hold an error result
  Squashfs: fix documentation typo, Cramfs filesystem limit is 256 MiB
  Squashfs: Fix oops when reading fsfuzzer corrupted filesystems

diff --git a/Documentation/filesystems/squashfs.txt b/Documentation/filesystems/squashfs.txt
index 3e79e4a7a3920ac659ad2b3b76ed339aaf04e9f3..b324c033035ad097fda59b86897ae0720df9f09b 100644 (file)
--- a/Documentation/filesystems/squashfs.txt
+++ b/Documentation/filesystems/squashfs.txt
@@ -22,7 +22,7 @@ Squashfs filesystem features versus Cramfs:
 
                                Squashfs                Cramfs
 
-Max filesystem size:           2^64                    16 MiB
+Max filesystem size:           2^64                    256 MiB
 Max file size:                 ~ 2 TiB                 16 MiB
 Max files:                     unlimited               unlimited
 Max directories:               unlimited               unlimited

diff --git a/fs/squashfs/block.c b/fs/squashfs/block.c
index c837dfc2b3c613799a228744e5de396ca206b1ee..321728f48f2d0c38204a312fbc67685428ee318e 100644 (file)
--- a/fs/squashfs/block.c
+++ b/fs/squashfs/block.c
@@ -80,7 +80,7 @@ static struct buffer_head *get_block_length(struct super_block *sb,
  * generated a larger block - this does occasionally happen with zlib).
  */
 int squashfs_read_data(struct super_block *sb, void **buffer, u64 index,
-                       int length, u64 *next_index, int srclength)
+                       int length, u64 *next_index, int srclength, int pages)
 {
        struct squashfs_sb_info *msblk = sb->s_fs_info;
        struct buffer_head **bh;
@@ -185,6 +185,14 @@ int squashfs_read_data(struct super_block *sb, void **buffer, u64 index,
                        }
 
                        if (msblk->stream.avail_out == 0) {
+                               if (page == pages) {
+                                       ERROR("zlib_inflate tried to "
+                                               "decompress too much data, "
+                                               "expected %d bytes.  Zlib "
+                                               "data probably corrupt\n",
+                                               srclength);
+                                       goto release_mutex;
+                               }
                                msblk->stream.next_out = buffer[page++];
                                msblk->stream.avail_out = PAGE_CACHE_SIZE;
                        }
@@ -268,7 +276,8 @@ block_release:
                put_bh(bh[k]);
 
 read_failure:
-       ERROR("sb_bread failed reading block 0x%llx\n", cur_index);
+       ERROR("squashfs_read_data failed to read block 0x%llx\n",
+                                       (unsigned long long) index);
        kfree(bh);
        return -EIO;
 }

diff --git a/fs/squashfs/cache.c b/fs/squashfs/cache.c
index f29eda16d25ebd6c9bee029b872ac97e5a31fc29..1c4739e33af638bf819278c755e2d656ec64288d 100644 (file)
--- a/fs/squashfs/cache.c
+++ b/fs/squashfs/cache.c
@@ -119,7 +119,7 @@ struct squashfs_cache_entry *squashfs_cache_get(struct super_block *sb,
 
                        entry->length = squashfs_read_data(sb, entry->data,
                                block, length, &entry->next_index,
-                               cache->block_size);
+                               cache->block_size, cache->pages);
 
                        spin_lock(&cache->lock);
 
@@ -406,7 +406,7 @@ int squashfs_read_table(struct super_block *sb, void *buffer, u64 block,
        for (i = 0; i < pages; i++, buffer += PAGE_CACHE_SIZE)
                data[i] = buffer;
        res = squashfs_read_data(sb, data, block, length |
-               SQUASHFS_COMPRESSED_BIT_BLOCK, NULL, length);
+               SQUASHFS_COMPRESSED_BIT_BLOCK, NULL, length, pages);
        kfree(data);
        return res;
 }

diff --git a/fs/squashfs/inode.c b/fs/squashfs/inode.c
index 7a63398bb855ab6982810ae366b577139e6abe92..9101dbde39ece6a9ca5d8b47d3344c1f3bdc6879 100644 (file)
--- a/fs/squashfs/inode.c
+++ b/fs/squashfs/inode.c
@@ -133,7 +133,8 @@ int squashfs_read_inode(struct inode *inode, long long ino)
        type = le16_to_cpu(sqshb_ino->inode_type);
        switch (type) {
        case SQUASHFS_REG_TYPE: {
-               unsigned int frag_offset, frag_size, frag;
+               unsigned int frag_offset, frag;
+               int frag_size;
                u64 frag_blk;
                struct squashfs_reg_inode *sqsh_ino = &squashfs_ino.reg;
 
@@ -175,7 +176,8 @@ int squashfs_read_inode(struct inode *inode, long long ino)
                break;
        }
        case SQUASHFS_LREG_TYPE: {
-               unsigned int frag_offset, frag_size, frag;
+               unsigned int frag_offset, frag;
+               int frag_size;
                u64 frag_blk;
                struct squashfs_lreg_inode *sqsh_ino = &squashfs_ino.lreg;
 

diff --git a/fs/squashfs/squashfs.h b/fs/squashfs/squashfs.h
index 6b2515d027d5b0545b0ac490baf1df9a1acd138c..0e9feb6adf7e120ccad9efd9815717fd44dbc83c 100644 (file)
--- a/fs/squashfs/squashfs.h
+++ b/fs/squashfs/squashfs.h
@@ -34,7 +34,7 @@ static inline struct squashfs_inode_info *squashfs_i(struct inode *inode)
 
 /* block.c */
 extern int squashfs_read_data(struct super_block *, void **, u64, int, u64 *,
-                               int);
+                               int, int);
 
 /* cache.c */
 extern struct squashfs_cache *squashfs_cache_init(char *, int, int);

diff --git a/fs/squashfs/super.c b/fs/squashfs/super.c
index 071df5b5b49184a28d354f217b78844002e4053b..681ec0d83799cc22595f44aadad42ca5d63e0538 100644 (file)
--- a/fs/squashfs/super.c
+++ b/fs/squashfs/super.c
@@ -389,7 +389,7 @@ static int __init init_squashfs_fs(void)
                return err;
        }
 
-       printk(KERN_INFO "squashfs: version 4.0 (2009/01/03) "
+       printk(KERN_INFO "squashfs: version 4.0 (2009/01/31) "
                "Phillip Lougher\n");
 
        return 0;