[PATCH 5/6] Squashfs: Compute expected length from inode size rather than block length

[Ahmad Fatoum <a.fatoum@pengutronix.de>]

This is a port of Linux commit a3f94cb99a854fa381fe7fadd97c4f61633717a5:

| Author:     Phillip Lougher <phillip@squashfs.org.uk>
| AuthorDate: Thu Aug 2 16:45:15 2018 +0100
|
| Previously in squashfs_readpage() when copying data into the page
| cache, it used the length of the datablock read from the filesystem
| (after decompression).  However, if the filesystem has been corrupted
| this data block may be short, which will leave pages unfilled.
|
| The fix for this is to compute the expected number of bytes to copy
| from the inode size, and use this to detect if the block is short.
|
| Signed-off-by: Phillip Lougher <phillip@squashfs.org.uk>
| Tested-by: Willy Tarreau <w@1wt.eu>
| Cc: Анатолий Тросиненко <anatoly.trosinenko@gmail.com>
| Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Reported-by: Richard Weinberger <richard@sigma-star.at>
Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
---
 fs/squashfs/file.c       | 26 ++++++++++----------------
 fs/squashfs/file_cache.c |  4 ++--
 fs/squashfs/squashfs.h   |  2 +-
 3 files changed, 13 insertions(+), 19 deletions(-)

diff --git a/fs/squashfs/file.c b/fs/squashfs/file.c
index 8316f0edb645..16914415299a 100644
--- a/fs/squashfs/file.c
+++ b/fs/squashfs/file.c
@@ -388,10 +388,9 @@ int squashfs_copy_cache(struct page *page, struct squashfs_cache_entry *buffer,
 }
 
 /* Read datablock stored packed inside a fragment (tail-end packed block) */
-static int squashfs_readpage_fragment(struct page *page)
+static int squashfs_readpage_fragment(struct page *page, int expected)
 {
 	struct inode *inode = page->inode;
-	struct squashfs_sb_info *msblk = inode->i_sb->s_fs_info;
 	struct squashfs_cache_entry *buffer = squashfs_get_fragment(inode->i_sb,
 		squashfs_i(inode)->fragment_block,
 		squashfs_i(inode)->fragment_size);
@@ -404,24 +403,16 @@ static int squashfs_readpage_fragment(struct page *page)
 			squashfs_i(inode)->fragment_block,
 			squashfs_i(inode)->fragment_size);
 	else
-		squashfs_copy_cache(page, buffer, i_size_read(inode) &
-			(msblk->block_size - 1),
+		squashfs_copy_cache(page, buffer, expected,
 			squashfs_i(inode)->fragment_offset);
 
 	squashfs_cache_put(buffer);
 	return res;
 }
 
-static int squashfs_readpage_sparse(struct page *page, int index, int file_end)
+static int squashfs_readpage_sparse(struct page *page, int expected)
 {
-	struct inode *inode = page->inode;
-	struct squashfs_sb_info *msblk = inode->i_sb->s_fs_info;
-	int bytes = index == file_end ?
-			(i_size_read(inode) & (msblk->block_size - 1)) :
-			 msblk->block_size;
-
-	squashfs_copy_cache(page, NULL, bytes, 0);
-
+	squashfs_copy_cache(page, NULL, expected, 0);
 	return 0;
 }
 
@@ -431,6 +422,9 @@ int squashfs_readpage(struct file *file, struct page *page)
 	struct squashfs_sb_info *msblk = inode->i_sb->s_fs_info;
 	int index = page->index >> (msblk->block_log - PAGE_CACHE_SHIFT);
 	int file_end = i_size_read(inode) >> msblk->block_log;
+	int expected = index == file_end ?
+			(i_size_read(inode) & (msblk->block_size - 1)) :
+			 msblk->block_size;
 	int res;
 
 	TRACE("Entered squashfs_readpage, page index %lx, start block %llx\n",
@@ -448,11 +442,11 @@ int squashfs_readpage(struct file *file, struct page *page)
 			goto out;
 
 		if (bsize == 0)
-			res = squashfs_readpage_sparse(page, index, file_end);
+			res = squashfs_readpage_sparse(page, expected);
 		else
-			res = squashfs_readpage_block(page, block, bsize);
+			res = squashfs_readpage_block(page, block, bsize, expected);
 	} else
-		res = squashfs_readpage_fragment(page);
+		res = squashfs_readpage_fragment(page, expected);
 
 	if (!res)
 		return 0;
diff --git a/fs/squashfs/file_cache.c b/fs/squashfs/file_cache.c
index fbd829849d18..0b64be0994c7 100644
--- a/fs/squashfs/file_cache.c
+++ b/fs/squashfs/file_cache.c
@@ -17,7 +17,7 @@
 #include "squashfs.h"
 
 /* Read separately compressed datablock and memcopy into page cache */
-int squashfs_readpage_block(struct page *page, u64 block, int bsize)
+int squashfs_readpage_block(struct page *page, u64 block, int bsize, int expected)
 {
 	struct inode *i = page->inode;
 	struct squashfs_cache_entry *buffer = squashfs_get_datablock(i->i_sb,
@@ -25,7 +25,7 @@ int squashfs_readpage_block(struct page *page, u64 block, int bsize)
 	int res = buffer->error;
 
 	if (!res)
-		res = squashfs_copy_cache(page, buffer, buffer->length, 0);
+		res = squashfs_copy_cache(page, buffer, expected, 0);
 
 	if (res)
 		ERROR("Unable to read page, block %llx, size %x\n", block,
diff --git a/fs/squashfs/squashfs.h b/fs/squashfs/squashfs.h
index 456021dcfd3e..1f2fee59d688 100644
--- a/fs/squashfs/squashfs.h
+++ b/fs/squashfs/squashfs.h
@@ -98,7 +98,7 @@ int squashfs_copy_cache(struct page *, struct squashfs_cache_entry *, int,
 extern int squashfs_readpage(struct file *file, struct page *page);
 
 /* file_xxx.c */
-extern int squashfs_readpage_block(struct page *, u64, int);
+extern int squashfs_readpage_block(struct page *, u64, int, int);
 
 /* id.c */
 extern int squashfs_get_id(struct super_block *, unsigned int, unsigned int *);
-- 
2.39.2