squashfs: make the fragment index table bounds check overflow-safe

squashfs_read_fragment_index_table() checks that the table fits before the
next one with:

	if (fragment_table_start + length > next_table)
		return ERR_PTR(-EINVAL);

fragment_table_start comes from the superblock and is not validated before
this point.  A start of 2^64 - length wraps the sum to zero, so the check
passes regardless of next_table and fails to reject the invalid table
ordering.

length then reaches kmalloc() through squashfs_read_table().  A fragment
count of 0xffffffff asks for 64MB, order 14.  GFP_KERNEL does not include
__GFP_NOWARN, so the page allocator warns before the mount fails with
-ENOMEM.  With panic_on_warn, the warning panics the kernel.

Compare the operands instead of adding them.  id.c and export.c avoid the
same wrap with an exact-size check.  Keep the inequality here because a
gap before the next table is still allowed.

Link: https://lore.kernel.org/20260822143328.68867-3-kmehltretter@gmail.com
Fixes: 1cac63cc9b2f ("Squashfs: add sanity checks to fragment reading at mount time")
Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Assisted-by: Claude:claude-opus-5
Cc: Phillip Lougher <phillip@squashfs.org.uk>
Cc: <stable@vger.kernel.org>

0 files changed, 0 insertions, 0 deletions