tree: https://git.kernel.org/pub/scm/linux/kernel/git/sashal/linux-stable.git queue-4.4 head: 6a08a9e7fb1525fa296d810d200954f6c18d07a2 commit: d9c7067ceb34ec223012997c1d57f3919528b7ae [13/14] squashfs: add more sanity checks in xattr id lookup config: arc-allyesconfig (attached as .config) compiler: arceb-elf-gcc (GCC) 9.3.0 reproduce (this is a W=1 build): wget https://raw.githubusercontent.com/intel/lkp-tests/master/sbin/make.cross -O ~/bin/make.cross chmod +x ~/bin/make.cross # https://git.kernel.org/pub/scm/linux/kernel/git/sashal/linux-stable.git/c... git remote add sashal-linux-stable https://git.kernel.org/pub/scm/linux/kernel/git/sashal/linux-stable.git git fetch --no-tags sashal-linux-stable queue-4.4 git checkout d9c7067ceb34ec223012997c1d57f3919528b7ae # save the attached .config to linux build tree COMPILER_INSTALL_PATH=$HOME/0day COMPILER=gcc-9.3.0 make.cross ARCH=arc If you fix the issue, kindly add following tag as appropriate Reported-by: kernel test robot <lkp(a)intel.com&gt; All warnings (new ones prefixed by >>): In file included from arch/arc/include/asm/bug.h:32, from include/linux/bug.h:4, from include/linux/thread_info.h:11, from include/asm-generic/preempt.h:4, from arch/arc/include/generated/asm/preempt.h:1, from include/linux/preempt.h:59, from include/linux/spinlock.h:50, from include/linux/wait.h:8, from include/linux/fs.h:5, from fs/squashfs/xattr_id.c:29: include/linux/cpumask.h: In function 'cpumask_check': include/linux/cpumask.h:117:19: warning: comparison of integer expressions of different signedness: 'unsigned int' and 'int' [-Wsign-compare] 117 | WARN_ON_ONCE(cpu >= nr_cpumask_bits); | ^~ include/asm-generic/bug.h:112:27: note: in definition of macro 'WARN_ON_ONCE' 112 | int __ret_warn_once = !!(condition); \ | ^~~~~~~~~ In file included from fs/squashfs/xattr_id.c:33: fs/squashfs/squashfs_fs.h: In function 'squashfs_block_size': fs/squashfs/squashfs_fs.h:135:24: warning: operand of ?: changes signedness from 'int' to 'u32' {aka 'unsigned int'} due to unsignedness of other operand [-Wsign-compare] 135 | return (size >> 25) ? -EIO : size; fs/squashfs/xattr_id.c: In function 'squashfs_xattr_lookup': 51 | if (index >= msblk->xattr_ids) | ^~ fs/squashfs/xattr_id.c: In function 'squashfs_read_xattr_id_table': 121 | for (n = 0; n < (indexes - 1); n++) { | ^ vim +51 fs/squashfs/xattr_id.c 37 38 /* 39 * Map xattr id using the xattr id look up table 40 */ 41 int squashfs_xattr_lookup(struct super_block *sb, unsigned int index, 42 int *count, unsigned int *size, unsigned long long *xattr) 43 { 44 struct squashfs_sb_info *msblk = sb->s_fs_info; 45 int block = SQUASHFS_XATTR_BLOCK(index); 46 int offset = SQUASHFS_XATTR_BLOCK_OFFSET(index); 47 u64 start_block; 48 struct squashfs_xattr_id id; 49 int err; 50 52 return -EINVAL; 53 54 start_block = le64_to_cpu(msblk->xattr_id_table[block]); 55 56 err = squashfs_read_metadata(sb, &id, &start_block, &offset, 57 sizeof(id)); 58 if (err < 0) 59 return err; 60 61 *xattr = le64_to_cpu(id.xattr); 62 *size = le32_to_cpu(id.size); 63 *count = le32_to_cpu(id.count); 64 return 0; 65 } 66 67 68 /* 69 * Read uncompressed xattr id lookup table indexes from disk into memory 70 */ 71 __le64 *squashfs_read_xattr_id_table(struct super_block *sb, u64 table_start, 72 u64 *xattr_table_start, int *xattr_ids) 73 { 74 struct squashfs_sb_info *msblk = sb->s_fs_info; 75 unsigned int len, indexes; 76 struct squashfs_xattr_id_table *id_table; 77 __le64 *table; 78 u64 start, end; 79 int n; 80 81 id_table = squashfs_read_table(sb, table_start, sizeof(*id_table)); 82 if (IS_ERR(id_table)) 83 return (__le64 *) id_table; 84 85 *xattr_table_start = le64_to_cpu(id_table->xattr_table_start); 86 *xattr_ids = le32_to_cpu(id_table->xattr_ids); 87 kfree(id_table); 88 89 /* Sanity check values */ 90 91 /* there is always at least one xattr id */ 92 if (*xattr_ids == 0) 93 return ERR_PTR(-EINVAL); 94 95 len = SQUASHFS_XATTR_BLOCK_BYTES(*xattr_ids); 96 indexes = SQUASHFS_XATTR_BLOCKS(*xattr_ids); 97 98 /* 99 * The computed size of the index table (len bytes) should exactly 100 * match the table start and end points 101 */ 102 start = table_start + sizeof(*id_table); 103 end = msblk->bytes_used; 104 105 if (len != (end - start)) 106 return ERR_PTR(-EINVAL); 107 108 table = squashfs_read_table(sb, start, len); 109 if (IS_ERR(table)) 110 return table; 111 112 /* table[0], table[1], ... table[indexes - 1] store the locations 113 * of the compressed xattr id blocks. Each entry should be less than 114 * the next (i.e. table[0] < table[1]), and the difference between them 115 * should be SQUASHFS_METADATA_SIZE or less. table[indexes - 1] 116 * should be less than table_start, and again the difference 117 * shouls be SQUASHFS_METADATA_SIZE or less. 118 * 119 * Finally xattr_table_start should be less than table[0]. 120 */ --- 0-DAY CI Kernel Test Service, Intel Corporation https://lists.01.org/hyperkitty/list/kbuild-all@lists.01.org