Squashfs maintainer closes overflows and crafted-image exploits

Phillip Lougher has submitted an 18-patch series for the Linux Squashfs driver that closes a wide set of arithmetic overflows, signedness mistakes, and missing sanity checks on values read from disk. Two fixes address issues first raised by AI-generated code reports; the rest came from a manual audit and testing of the filesystem code.

Most of the bugs let a malicious or corrupted Squashfs image provoke out-of-bounds access, hang readers, or fail mounts in surprising ways. In several cases Lougher includes reproducers showing how an image can be altered so files or directories meant only for the superuser become reachable by unprivileged users. On locked-down embedded systems that ship without the usual Squashfs tools, those changes need nothing more elaborate than echo and dd: for example by planting a replacement root inode or directory with looser permissions and retargeting the superblock or lookup tables at it. Related holes left signed integers holding block numbers for multi-tebibyte files (so a large sparse read could hang), treated xattr counts as signed (so huge or zero counts could loop or silently succeed), and deferred bounds checks until after fragment cache or decompressor resources had already been claimed.

A final group of changes stops mount-time index tables from trying to allocate tens of megabytes when a crafted superblock claims enormous inode, fragment, or export counts. The original paths dated from an era of small images and could request well over 4 MiB, up to around 64 MiB. The series introduces caches that cap that usage at four pages and tightens length and overflow checks so arithmetic wraparound cannot slip past the existing end-of-table guards before the large allocation runs.

Preparatory patches replace old preprocessor macros with typed inline helpers so widths and signedness are explicit and later checks can live in one place. Lougher notes that default metadata compression and mount-time layout rules make some privilege tricks hard in ordinary deployments, but the kernel still should not walk off tables, hang on large files, or briefly pin multi-megabyte slabs on bad on-disk values.