]> git.ipfire.org Git - thirdparty/kernel/stable-queue.git/commitdiff
5.15-stable patches
authorGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Tue, 7 Feb 2023 09:35:45 +0000 (10:35 +0100)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Tue, 7 Feb 2023 09:35:45 +0000 (10:35 +0100)
added patches:
drm-i915-fix-potential-bit_17-double-free.patch
fpga-stratix10-soc-fix-return-value-check-in-s10_ops_write_init.patch
highmem-round-down-the-address-passed-to-kunmap_flush_on_unmap.patch
mm-swapfile-add-cond_resched-in-get_swap_pages.patch
nvmem-core-fix-cell-removal-on-error.patch
nvmem-core-initialise-nvmem-id-early.patch
nvmem-core-remove-nvmem_config-wp_gpio.patch
squashfs-fix-handling-and-sanity-checking-of-xattr_ids-count.patch

queue-5.15/drm-i915-fix-potential-bit_17-double-free.patch [new file with mode: 0644]
queue-5.15/fpga-stratix10-soc-fix-return-value-check-in-s10_ops_write_init.patch [new file with mode: 0644]
queue-5.15/highmem-round-down-the-address-passed-to-kunmap_flush_on_unmap.patch [new file with mode: 0644]
queue-5.15/mm-swapfile-add-cond_resched-in-get_swap_pages.patch [new file with mode: 0644]
queue-5.15/nvmem-core-fix-cell-removal-on-error.patch [new file with mode: 0644]
queue-5.15/nvmem-core-initialise-nvmem-id-early.patch [new file with mode: 0644]
queue-5.15/nvmem-core-remove-nvmem_config-wp_gpio.patch [new file with mode: 0644]
queue-5.15/series
queue-5.15/squashfs-fix-handling-and-sanity-checking-of-xattr_ids-count.patch [new file with mode: 0644]

diff --git a/queue-5.15/drm-i915-fix-potential-bit_17-double-free.patch b/queue-5.15/drm-i915-fix-potential-bit_17-double-free.patch
new file mode 100644 (file)
index 0000000..0759b31
--- /dev/null
@@ -0,0 +1,54 @@
+From 7057a8f126f14f14b040faecfa220fd27c6c2f85 Mon Sep 17 00:00:00 2001
+From: Rob Clark <robdclark@chromium.org>
+Date: Fri, 27 Jan 2023 12:05:31 -0800
+Subject: drm/i915: Fix potential bit_17 double-free
+
+From: Rob Clark <robdclark@chromium.org>
+
+commit 7057a8f126f14f14b040faecfa220fd27c6c2f85 upstream.
+
+A userspace with multiple threads racing I915_GEM_SET_TILING to set the
+tiling to I915_TILING_NONE could trigger a double free of the bit_17
+bitmask.  (Or conversely leak memory on the transition to tiled.)  Move
+allocation/free'ing of the bitmask within the section protected by the
+obj lock.
+
+Signed-off-by: Rob Clark <robdclark@chromium.org>
+Fixes: 2850748ef876 ("drm/i915: Pull i915_vma_pin under the vm->mutex")
+Cc: <stable@vger.kernel.org> # v5.5+
+[tursulin: Correct fixes tag and added cc stable.]
+Reviewed-by: Tvrtko Ursulin <tvrtko.ursulin@intel.com>
+Signed-off-by: Tvrtko Ursulin <tvrtko.ursulin@intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20230127200550.3531984-1-robdclark@gmail.com
+(cherry picked from commit 10e0cbaaf1104f449d695c80bcacf930dcd3c42e)
+Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/i915/gem/i915_gem_tiling.c |    9 +++++----
+ 1 file changed, 5 insertions(+), 4 deletions(-)
+
+--- a/drivers/gpu/drm/i915/gem/i915_gem_tiling.c
++++ b/drivers/gpu/drm/i915/gem/i915_gem_tiling.c
+@@ -294,10 +294,6 @@ i915_gem_object_set_tiling(struct drm_i9
+       spin_unlock(&obj->vma.lock);
+       obj->tiling_and_stride = tiling | stride;
+-      i915_gem_object_unlock(obj);
+-
+-      /* Force the fence to be reacquired for GTT access */
+-      i915_gem_object_release_mmap_gtt(obj);
+       /* Try to preallocate memory required to save swizzling on put-pages */
+       if (i915_gem_object_needs_bit17_swizzle(obj)) {
+@@ -310,6 +306,11 @@ i915_gem_object_set_tiling(struct drm_i9
+               obj->bit_17 = NULL;
+       }
++      i915_gem_object_unlock(obj);
++
++      /* Force the fence to be reacquired for GTT access */
++      i915_gem_object_release_mmap_gtt(obj);
++
+       return 0;
+ }
diff --git a/queue-5.15/fpga-stratix10-soc-fix-return-value-check-in-s10_ops_write_init.patch b/queue-5.15/fpga-stratix10-soc-fix-return-value-check-in-s10_ops_write_init.patch
new file mode 100644 (file)
index 0000000..3ae4836
--- /dev/null
@@ -0,0 +1,39 @@
+From 65ea840afd508194b0ee903256162aa87e46ec30 Mon Sep 17 00:00:00 2001
+From: Zheng Yongjun <zhengyongjun3@huawei.com>
+Date: Sat, 26 Nov 2022 07:14:30 +0000
+Subject: fpga: stratix10-soc: Fix return value check in s10_ops_write_init()
+
+From: Zheng Yongjun <zhengyongjun3@huawei.com>
+
+commit 65ea840afd508194b0ee903256162aa87e46ec30 upstream.
+
+In case of error, the function stratix10_svc_allocate_memory()
+returns ERR_PTR() and never returns NULL. The NULL test in the
+return value check should be replaced with IS_ERR().
+
+Fixes: e7eef1d7633a ("fpga: add intel stratix10 soc fpga manager driver")
+Signed-off-by: Zheng Yongjun <zhengyongjun3@huawei.com>
+Reviewed-by: Russ Weight <russell.h.weight@intel.com>
+Cc: stable@vger.kernel.org
+Acked-by: Xu Yilun <yilun.xu@intel.com>
+Link: https://lore.kernel.org/r/20221126071430.19540-1-zhengyongjun3@huawei.com
+Signed-off-by: Xu Yilun <yilun.xu@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/fpga/stratix10-soc.c |    4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/fpga/stratix10-soc.c
++++ b/drivers/fpga/stratix10-soc.c
+@@ -213,9 +213,9 @@ static int s10_ops_write_init(struct fpg
+       /* Allocate buffers from the service layer's pool. */
+       for (i = 0; i < NUM_SVC_BUFS; i++) {
+               kbuf = stratix10_svc_allocate_memory(priv->chan, SVC_BUF_SIZE);
+-              if (!kbuf) {
++              if (IS_ERR(kbuf)) {
+                       s10_free_buffers(mgr);
+-                      ret = -ENOMEM;
++                      ret = PTR_ERR(kbuf);
+                       goto init_done;
+               }
diff --git a/queue-5.15/highmem-round-down-the-address-passed-to-kunmap_flush_on_unmap.patch b/queue-5.15/highmem-round-down-the-address-passed-to-kunmap_flush_on_unmap.patch
new file mode 100644 (file)
index 0000000..8e24b1c
--- /dev/null
@@ -0,0 +1,57 @@
+From 88d7b12068b95731c280af8ce88e8ee9561f96de Mon Sep 17 00:00:00 2001
+From: "Matthew Wilcox (Oracle)" <willy@infradead.org>
+Date: Thu, 26 Jan 2023 20:07:27 +0000
+Subject: highmem: round down the address passed to kunmap_flush_on_unmap()
+
+From: Matthew Wilcox (Oracle) <willy@infradead.org>
+
+commit 88d7b12068b95731c280af8ce88e8ee9561f96de upstream.
+
+We already round down the address in kunmap_local_indexed() which is the
+other implementation of __kunmap_local().  The only implementation of
+kunmap_flush_on_unmap() is PA-RISC which is expecting a page-aligned
+address.  This may be causing PA-RISC to be flushing the wrong addresses
+currently.
+
+Link: https://lkml.kernel.org/r/20230126200727.1680362-1-willy@infradead.org
+Signed-off-by: Matthew Wilcox (Oracle) <willy@infradead.org>
+Fixes: 298fa1ad5571 ("highmem: Provide generic variant of kmap_atomic*")
+Reviewed-by: Ira Weiny <ira.weiny@intel.com>
+Cc: "Fabio M. De Francesco" <fmdefrancesco@gmail.com>
+Cc: Al Viro <viro@zeniv.linux.org.uk>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Cc: Helge Deller <deller@gmx.de>
+Cc: Alexander Potapenko <glider@google.com>
+Cc: Andrey Konovalov <andreyknvl@gmail.com>
+Cc: Bagas Sanjaya <bagasdotme@gmail.com>
+Cc: David Sterba <dsterba@suse.com>
+Cc: Kees Cook <keescook@chromium.org>
+Cc: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+Cc: Tony Luck <tony.luck@intel.com>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ include/linux/highmem-internal.h |    4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/include/linux/highmem-internal.h
++++ b/include/linux/highmem-internal.h
+@@ -184,7 +184,7 @@ static inline void *kmap_local_pfn(unsig
+ static inline void __kunmap_local(void *addr)
+ {
+ #ifdef ARCH_HAS_FLUSH_ON_KUNMAP
+-      kunmap_flush_on_unmap(addr);
++      kunmap_flush_on_unmap(PTR_ALIGN_DOWN(addr, PAGE_SIZE));
+ #endif
+ }
+@@ -211,7 +211,7 @@ static inline void *kmap_atomic_pfn(unsi
+ static inline void __kunmap_atomic(void *addr)
+ {
+ #ifdef ARCH_HAS_FLUSH_ON_KUNMAP
+-      kunmap_flush_on_unmap(addr);
++      kunmap_flush_on_unmap(PTR_ALIGN_DOWN(addr, PAGE_SIZE));
+ #endif
+       pagefault_enable();
+       if (IS_ENABLED(CONFIG_PREEMPT_RT))
diff --git a/queue-5.15/mm-swapfile-add-cond_resched-in-get_swap_pages.patch b/queue-5.15/mm-swapfile-add-cond_resched-in-get_swap_pages.patch
new file mode 100644 (file)
index 0000000..2eb9f19
--- /dev/null
@@ -0,0 +1,45 @@
+From 7717fc1a12f88701573f9ed897cc4f6699c661e3 Mon Sep 17 00:00:00 2001
+From: Longlong Xia <xialonglong1@huawei.com>
+Date: Sat, 28 Jan 2023 09:47:57 +0000
+Subject: mm/swapfile: add cond_resched() in get_swap_pages()
+
+From: Longlong Xia <xialonglong1@huawei.com>
+
+commit 7717fc1a12f88701573f9ed897cc4f6699c661e3 upstream.
+
+The softlockup still occurs in get_swap_pages() under memory pressure.  64
+CPU cores, 64GB memory, and 28 zram devices, the disksize of each zram
+device is 50MB with same priority as si.  Use the stress-ng tool to
+increase memory pressure, causing the system to oom frequently.
+
+The plist_for_each_entry_safe() loops in get_swap_pages() could reach tens
+of thousands of times to find available space (extreme case:
+cond_resched() is not called in scan_swap_map_slots()).  Let's add
+cond_resched() into get_swap_pages() when failed to find available space
+to avoid softlockup.
+
+Link: https://lkml.kernel.org/r/20230128094757.1060525-1-xialonglong1@huawei.com
+Signed-off-by: Longlong Xia <xialonglong1@huawei.com>
+Reviewed-by: "Huang, Ying" <ying.huang@intel.com>
+Cc: Chen Wandun <chenwandun@huawei.com>
+Cc: Huang Ying <ying.huang@intel.com>
+Cc: Kefeng Wang <wangkefeng.wang@huawei.com>
+Cc: Nanyong Sun <sunnanyong@huawei.com>
+Cc: Hugh Dickins <hughd@google.com>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ mm/swapfile.c |    1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/mm/swapfile.c
++++ b/mm/swapfile.c
+@@ -1093,6 +1093,7 @@ start_over:
+                       goto check_out;
+               pr_debug("scan_swap_map of si %d failed to find offset\n",
+                       si->type);
++              cond_resched();
+               spin_lock(&swap_avail_lock);
+ nextsi:
diff --git a/queue-5.15/nvmem-core-fix-cell-removal-on-error.patch b/queue-5.15/nvmem-core-fix-cell-removal-on-error.patch
new file mode 100644 (file)
index 0000000..49db769
--- /dev/null
@@ -0,0 +1,42 @@
+From db3546d58b5a0fa581d9c9f2bdc2856fa6c5e43e Mon Sep 17 00:00:00 2001
+From: Michael Walle <michael@walle.cc>
+Date: Fri, 27 Jan 2023 10:40:13 +0000
+Subject: nvmem: core: fix cell removal on error
+
+From: Michael Walle <michael@walle.cc>
+
+commit db3546d58b5a0fa581d9c9f2bdc2856fa6c5e43e upstream.
+
+nvmem_add_cells() could return an error after some cells are already
+added to the provider. In this case, the added cells are not removed.
+Remove any registered cells if nvmem_add_cells() fails.
+
+Fixes: fa72d847d68d7 ("nvmem: check the return value of nvmem_add_cells()")
+Cc: stable@vger.kernel.org
+Signed-off-by: Michael Walle <michael@walle.cc>
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Link: https://lore.kernel.org/r/20230127104015.23839-9-srinivas.kandagatla@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/nvmem/core.c |    3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+--- a/drivers/nvmem/core.c
++++ b/drivers/nvmem/core.c
+@@ -844,7 +844,7 @@ struct nvmem_device *nvmem_register(cons
+       if (config->cells) {
+               rval = nvmem_add_cells(nvmem, config->cells, config->ncells);
+               if (rval)
+-                      goto err_teardown_compat;
++                      goto err_remove_cells;
+       }
+       rval = nvmem_add_cells_from_table(nvmem);
+@@ -861,7 +861,6 @@ struct nvmem_device *nvmem_register(cons
+ err_remove_cells:
+       nvmem_device_remove_all_cells(nvmem);
+-err_teardown_compat:
+       if (config->compat)
+               nvmem_sysfs_remove_compat(nvmem, config);
+ err_device_del:
diff --git a/queue-5.15/nvmem-core-initialise-nvmem-id-early.patch b/queue-5.15/nvmem-core-initialise-nvmem-id-early.patch
new file mode 100644 (file)
index 0000000..a5dff84
--- /dev/null
@@ -0,0 +1,43 @@
+From 3bd747c7ea13cb145f0d84444e00df928b0842d9 Mon Sep 17 00:00:00 2001
+From: "Russell King (Oracle)" <rmk+kernel@armlinux.org.uk>
+Date: Fri, 27 Jan 2023 10:40:08 +0000
+Subject: nvmem: core: initialise nvmem->id early
+
+From: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
+
+commit 3bd747c7ea13cb145f0d84444e00df928b0842d9 upstream.
+
+The error path for wp_gpio attempts to free the IDA nvmem->id, but
+this has yet to be assigned, so will always be zero - leaking the
+ID allocated by ida_alloc(). Fix this by moving the initialisation
+of nvmem->id earlier.
+
+Fixes: f7d8d7dcd978 ("nvmem: fix memory leak in error path")
+Cc: stable@vger.kernel.org
+Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Link: https://lore.kernel.org/r/20230127104015.23839-4-srinivas.kandagatla@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/nvmem/core.c |    3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/nvmem/core.c
++++ b/drivers/nvmem/core.c
+@@ -766,6 +766,8 @@ struct nvmem_device *nvmem_register(cons
+               return ERR_PTR(rval);
+       }
++      nvmem->id = rval;
++
+       if (config->wp_gpio)
+               nvmem->wp_gpio = config->wp_gpio;
+       else if (!config->ignore_wp)
+@@ -781,7 +783,6 @@ struct nvmem_device *nvmem_register(cons
+       kref_init(&nvmem->refcnt);
+       INIT_LIST_HEAD(&nvmem->cells);
+-      nvmem->id = rval;
+       nvmem->owner = config->owner;
+       if (!nvmem->owner && config->dev->driver)
+               nvmem->owner = config->dev->driver->owner;
diff --git a/queue-5.15/nvmem-core-remove-nvmem_config-wp_gpio.patch b/queue-5.15/nvmem-core-remove-nvmem_config-wp_gpio.patch
new file mode 100644 (file)
index 0000000..9ec2c6d
--- /dev/null
@@ -0,0 +1,53 @@
+From 569653f022a29a1a44ea9de5308b657228303fa5 Mon Sep 17 00:00:00 2001
+From: "Russell King (Oracle)" <rmk+kernel@armlinux.org.uk>
+Date: Fri, 27 Jan 2023 10:40:09 +0000
+Subject: nvmem: core: remove nvmem_config wp_gpio
+
+From: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
+
+commit 569653f022a29a1a44ea9de5308b657228303fa5 upstream.
+
+No one provides wp_gpio, so let's remove it to avoid issues with
+the nvmem core putting this gpio.
+
+Cc: stable@vger.kernel.org
+Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Link: https://lore.kernel.org/r/20230127104015.23839-5-srinivas.kandagatla@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/nvmem/core.c           |    4 +---
+ include/linux/nvmem-provider.h |    2 --
+ 2 files changed, 1 insertion(+), 5 deletions(-)
+
+--- a/drivers/nvmem/core.c
++++ b/drivers/nvmem/core.c
+@@ -768,9 +768,7 @@ struct nvmem_device *nvmem_register(cons
+       nvmem->id = rval;
+-      if (config->wp_gpio)
+-              nvmem->wp_gpio = config->wp_gpio;
+-      else if (!config->ignore_wp)
++      if (!config->ignore_wp)
+               nvmem->wp_gpio = gpiod_get_optional(config->dev, "wp",
+                                                   GPIOD_OUT_HIGH);
+       if (IS_ERR(nvmem->wp_gpio)) {
+--- a/include/linux/nvmem-provider.h
++++ b/include/linux/nvmem-provider.h
+@@ -66,7 +66,6 @@ struct nvmem_keepout {
+  * @word_size:        Minimum read/write access granularity.
+  * @stride:   Minimum read/write access stride.
+  * @priv:     User context passed to read/write callbacks.
+- * @wp-gpio:  Write protect pin
+  * @ignore_wp:  Write Protect pin is managed by the provider.
+  *
+  * Note: A default "nvmem<id>" name will be assigned to the device if
+@@ -81,7 +80,6 @@ struct nvmem_config {
+       const char              *name;
+       int                     id;
+       struct module           *owner;
+-      struct gpio_desc        *wp_gpio;
+       const struct nvmem_cell_info    *cells;
+       int                     ncells;
+       const struct nvmem_keepout *keepout;
index 28e907bcad15486edb88514bb970ed4e3526d1ee..dba49dbc560cbfc7aaee08b69a2a0016c9c85f25 100644 (file)
@@ -91,3 +91,11 @@ mm-hugetlb-proc-check-for-hugetlb-shared-pmd-in-proc-pid-smaps.patch
 usb-gadget-f_uac2-fix-incorrect-increment-of-bnumendpoints.patch
 kernel-irq-irqdomain.c-fix-memory-leak-with-using-debugfs_lookup.patch
 x86-debug-fix-stack-recursion-caused-by-wrongly-ordered-dr7-accesses.patch
+fpga-stratix10-soc-fix-return-value-check-in-s10_ops_write_init.patch
+mm-swapfile-add-cond_resched-in-get_swap_pages.patch
+highmem-round-down-the-address-passed-to-kunmap_flush_on_unmap.patch
+squashfs-fix-handling-and-sanity-checking-of-xattr_ids-count.patch
+drm-i915-fix-potential-bit_17-double-free.patch
+nvmem-core-initialise-nvmem-id-early.patch
+nvmem-core-remove-nvmem_config-wp_gpio.patch
+nvmem-core-fix-cell-removal-on-error.patch
diff --git a/queue-5.15/squashfs-fix-handling-and-sanity-checking-of-xattr_ids-count.patch b/queue-5.15/squashfs-fix-handling-and-sanity-checking-of-xattr_ids-count.patch
new file mode 100644 (file)
index 0000000..b8574df
--- /dev/null
@@ -0,0 +1,143 @@
+From f65c4bbbd682b0877b669828b4e033b8d5d0a2dc Mon Sep 17 00:00:00 2001
+From: Phillip Lougher <phillip@squashfs.org.uk>
+Date: Fri, 27 Jan 2023 06:18:42 +0000
+Subject: Squashfs: fix handling and sanity checking of xattr_ids count
+
+From: Phillip Lougher <phillip@squashfs.org.uk>
+
+commit f65c4bbbd682b0877b669828b4e033b8d5d0a2dc upstream.
+
+A Sysbot [1] corrupted filesystem exposes two flaws in the handling and
+sanity checking of the xattr_ids count in the filesystem.  Both of these
+flaws cause computation overflow due to incorrect typing.
+
+In the corrupted filesystem the xattr_ids value is 4294967071, which
+stored in a signed variable becomes the negative number -225.
+
+Flaw 1 (64-bit systems only):
+
+The signed integer xattr_ids variable causes sign extension.
+
+This causes variable overflow in the SQUASHFS_XATTR_*(A) macros.  The
+variable is first multiplied by sizeof(struct squashfs_xattr_id) where the
+type of the sizeof operator is "unsigned long".
+
+On a 64-bit system this is 64-bits in size, and causes the negative number
+to be sign extended and widened to 64-bits and then become unsigned.  This
+produces the very large number 18446744073709548016 or 2^64 - 3600.  This
+number when rounded up by SQUASHFS_METADATA_SIZE - 1 (8191 bytes) and
+divided by SQUASHFS_METADATA_SIZE overflows and produces a length of 0
+(stored in len).
+
+Flaw 2 (32-bit systems only):
+
+On a 32-bit system the integer variable is not widened by the unsigned
+long type of the sizeof operator (32-bits), and the signedness of the
+variable has no effect due it always being treated as unsigned.
+
+The above corrupted xattr_ids value of 4294967071, when multiplied
+overflows and produces the number 4294963696 or 2^32 - 3400.  This number
+when rounded up by SQUASHFS_METADATA_SIZE - 1 (8191 bytes) and divided by
+SQUASHFS_METADATA_SIZE overflows again and produces a length of 0.
+
+The effect of the 0 length computation:
+
+In conjunction with the corrupted xattr_ids field, the filesystem also has
+a corrupted xattr_table_start value, where it matches the end of
+filesystem value of 850.
+
+This causes the following sanity check code to fail because the
+incorrectly computed len of 0 matches the incorrect size of the table
+reported by the superblock (0 bytes).
+
+    len = SQUASHFS_XATTR_BLOCK_BYTES(*xattr_ids);
+    indexes = SQUASHFS_XATTR_BLOCKS(*xattr_ids);
+
+    /*
+     * The computed size of the index table (len bytes) should exactly
+     * match the table start and end points
+    */
+    start = table_start + sizeof(*id_table);
+    end = msblk->bytes_used;
+
+    if (len != (end - start))
+            return ERR_PTR(-EINVAL);
+
+Changing the xattr_ids variable to be "usigned int" fixes the flaw on a
+64-bit system.  This relies on the fact the computation is widened by the
+unsigned long type of the sizeof operator.
+
+Casting the variable to u64 in the above macro fixes this flaw on a 32-bit
+system.
+
+It also means 64-bit systems do not implicitly rely on the type of the
+sizeof operator to widen the computation.
+
+[1] https://lore.kernel.org/lkml/000000000000cd44f005f1a0f17f@google.com/
+
+Link: https://lkml.kernel.org/r/20230127061842.10965-1-phillip@squashfs.org.uk
+Fixes: 506220d2ba21 ("squashfs: add more sanity checks in xattr id lookup")
+Signed-off-by: Phillip Lougher <phillip@squashfs.org.uk>
+Reported-by: <syzbot+082fa4af80a5bb1a9843@syzkaller.appspotmail.com>
+Cc: Alexey Khoroshilov <khoroshilov@ispras.ru>
+Cc: Fedor Pchelkin <pchelkin@ispras.ru>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/squashfs/squashfs_fs.h    |    2 +-
+ fs/squashfs/squashfs_fs_sb.h |    2 +-
+ fs/squashfs/xattr.h          |    4 ++--
+ fs/squashfs/xattr_id.c       |    2 +-
+ 4 files changed, 5 insertions(+), 5 deletions(-)
+
+--- a/fs/squashfs/squashfs_fs.h
++++ b/fs/squashfs/squashfs_fs.h
+@@ -183,7 +183,7 @@ static inline int squashfs_block_size(__
+ #define SQUASHFS_ID_BLOCK_BYTES(A)    (SQUASHFS_ID_BLOCKS(A) *\
+                                       sizeof(u64))
+ /* xattr id lookup table defines */
+-#define SQUASHFS_XATTR_BYTES(A)               ((A) * sizeof(struct squashfs_xattr_id))
++#define SQUASHFS_XATTR_BYTES(A)               (((u64) (A)) * sizeof(struct squashfs_xattr_id))
+ #define SQUASHFS_XATTR_BLOCK(A)               (SQUASHFS_XATTR_BYTES(A) / \
+                                       SQUASHFS_METADATA_SIZE)
+--- a/fs/squashfs/squashfs_fs_sb.h
++++ b/fs/squashfs/squashfs_fs_sb.h
+@@ -63,7 +63,7 @@ struct squashfs_sb_info {
+       long long                               bytes_used;
+       unsigned int                            inodes;
+       unsigned int                            fragments;
+-      int                                     xattr_ids;
++      unsigned int                            xattr_ids;
+       unsigned int                            ids;
+       bool                                    panic_on_errors;
+ };
+--- a/fs/squashfs/xattr.h
++++ b/fs/squashfs/xattr.h
+@@ -10,12 +10,12 @@
+ #ifdef CONFIG_SQUASHFS_XATTR
+ extern __le64 *squashfs_read_xattr_id_table(struct super_block *, u64,
+-              u64 *, int *);
++              u64 *, unsigned int *);
+ extern int squashfs_xattr_lookup(struct super_block *, unsigned int, int *,
+               unsigned int *, unsigned long long *);
+ #else
+ static inline __le64 *squashfs_read_xattr_id_table(struct super_block *sb,
+-              u64 start, u64 *xattr_table_start, int *xattr_ids)
++              u64 start, u64 *xattr_table_start, unsigned int *xattr_ids)
+ {
+       struct squashfs_xattr_id_table *id_table;
+--- a/fs/squashfs/xattr_id.c
++++ b/fs/squashfs/xattr_id.c
+@@ -56,7 +56,7 @@ int squashfs_xattr_lookup(struct super_b
+  * Read uncompressed xattr id lookup table indexes from disk into memory
+  */
+ __le64 *squashfs_read_xattr_id_table(struct super_block *sb, u64 table_start,
+-              u64 *xattr_table_start, int *xattr_ids)
++              u64 *xattr_table_start, unsigned int *xattr_ids)
+ {
+       struct squashfs_sb_info *msblk = sb->s_fs_info;
+       unsigned int len, indexes;