Star0
11
Code
Code
Issues2
Pull Requests1
Discussion
Wiki
Analysis
Star0
11
Open
fix(cve): 修复 CVE-2026-71973 在 uboot-tools 中的漏洞 #130
infra_teamAdd on 8 days ago
fix(cve): 修复 CVE-2026-71973 在 uboot-tools 中的漏洞 #130
Open
infra_teamAdd on 8 days ago
Merged frominfra_team/uboot-toolsfix-CVE-2026-71973-openEuler-24.03-LTS-SP4intosrc-openeuler/uboot-toolsopenEuler-24.03-LTS-SP4
Total: 3 files changed+155-1
Abackport-0001-CVE-2026-71973.patch+81-0
@@ -0,0 +1,81 @@
1+From 59fd62d71c6a04b3ab9db848414a7c386cfd2cfb Mon Sep 17 00:00:00 2001
2+From: Joao Marcos Costa <joaomarcos.costa@bootlin.com>
3+Date: Wed, 19 Feb 2025 11:16:33 +0100
4+Subject: [PATCH] fs/squashfs: fix potential integer overflows
5+ 
6+The length of buffers used to read inode tables, directory tables, and
7+reading a file are calculated as: number of blocks * block size, and
8+such plain multiplication is prone to overflowing (thus unsafe).
9+ 
10+Replace it by __builtin_mul_overflow, i.e. safe math.
11+ 
12+Upstream-commit: https://github.com/u-boot/u-boot/commit/59fd62d71c6a04b3ab9db848414a7c386cfd2cfb
13+Signed-off-by: Joao Marcos Costa <joaomarcos.costa@bootlin.com>
14+---
15+ fs/squashfs/sqfs.c | 18 +++++++++++++++---
16+ 1 file changed, 15 insertions(+), 3 deletions(-)
17+ 
18+diff --git a/fs/squashfs/sqfs.c b/fs/squashfs/sqfs.c
19+index b9314019b1bc..8fac6c6c5a98 100644
20+--- a/fs/squashfs/sqfs.c
21++++ b/fs/squashfs/sqfs.c
22+@@ -719,6 +719,7 @@ static int sqfs_read_inode_table(unsigned char **inode_table)
23+ u32 src_len, dest_offset = 0;
24+ unsigned long dest_len = 0;
25+ bool compressed;
26++ size_t buf_size;
27+
28+ table_size = get_unaligned_le64(&sblk->directory_table_start) -
29+ get_unaligned_le64(&sblk->inode_table_start);
30+@@ -728,7 +729,10 @@ static int sqfs_read_inode_table(unsigned char **inode_table)
31+ sblk->directory_table_start, &table_offset);
32+
33+ /* Allocate a proper sized buffer (itb) to store the inode table */
34+- itb = malloc_cache_aligned(n_blks * ctxt.cur_dev->blksz);
35++ if (__builtin_mul_overflow(n_blks, ctxt.cur_dev->blksz, &buf_size))
36++ return -EINVAL;
37++
38++ itb = malloc_cache_aligned(buf_size);
39+ if (!itb)
40+ return -ENOMEM;
41+
42+@@ -806,6 +810,7 @@ static int sqfs_read_directory_table(unsigned char **dir_table, u32 **pos_list)
43+ u32 src_len, dest_offset = 0;
44+ unsigned long dest_len = 0;
45+ bool compressed;
46++ size_t buf_size;
47+
48+ *dir_table = NULL;
49+ *pos_list = NULL;
50+@@ -818,7 +823,10 @@ static int sqfs_read_directory_table(unsigned char **dir_table, u32 **pos_list)
51+ sblk->fragment_table_start, &table_offset);
52+
53+ /* Allocate a proper sized buffer (dtb) to store the directory table */
54+- dtb = malloc_cache_aligned(n_blks * ctxt.cur_dev->blksz);
55++ if (__builtin_mul_overflow(n_blks, ctxt.cur_dev->blksz, &buf_size))
56++ return -EINVAL;
57++
58++ dtb = malloc_cache_aligned(buf_size);
59+ if (!dtb)
60+ return -ENOMEM;
61+
62+@@ -1369,6 +1377,7 @@ static int sqfs_read_nest(const char *filename, void *buf, loff_t offset,
63+ unsigned long dest_len;
64+ struct fs_dirent *dent;
65+ unsigned char *ipos;
66++ size_t buf_size;
67+
68+ *actread = 0;
69+
70+@@ -1573,7 +1582,10 @@ static int sqfs_read_nest(const char *filename, void *buf, loff_t offset,
71+ table_offset = frag_entry.start - (start * ctxt.cur_dev->blksz);
72+ n_blks = DIV_ROUND_UP(table_size + table_offset, ctxt.cur_dev->blksz);
73+
74+- fragment = malloc_cache_aligned(n_blks * ctxt.cur_dev->blksz);
75++ if (__builtin_mul_overflow(n_blks, ctxt.cur_dev->blksz, &buf_size))
76++ return -EINVAL;
77++
78++ fragment = malloc_cache_aligned(buf_size);
79+
80+ if (!fragment) {
81+ ret = -ENOMEM;
Abackport-0002-CVE-2026-71973.patch+67-0
@@ -0,0 +1,67 @@
1+From 561ae28cb56a082cfa90c1c421c4955bc215470b Mon Sep 17 00:00:00 2001
2+From: Shahriyar Jalayeri <shahriyar@byteray.co.uk>
3+Date: Tue, 28 Jul 2026 08:55:39 +0200
4+Subject: [PATCH] fs/squashfs: fix integer overflow in directory table
5+ allocation
6+ 
7+sqfs_read_directory_table() allocates the directory table with
8+malloc(metablks_count * SQFS_METADATA_BLOCK_SIZE). metablks_count is an
9+int and SQFS_METADATA_BLOCK_SIZE is 8192, so the multiply is evaluated in
10+int and wraps for metablks_count >= 2^19. metablks_count comes from the
11+attacker-controlled superblock (sqfs_count_metablks() grows it by one per
12+2-byte metadata header), so a crafted image under-allocates the buffer
13+while the fill loop still writes metablks_count metadata blocks into it,
14+a heap out-of-bounds write. It is reached by listing or reading the image
15+(sqfsls / sqfsload). The position list allocation on the next line has the
16+same unchecked-multiply shape.
17+ 
18+Size both allocations with __builtin_mul_overflow() and reject the image
19+on overflow, as the disk-read buffers earlier in the same function already
20+do. Set the error return when either allocation fails so the caller does
21+not proceed with a NULL directory table.
22+ 
23+Fixes: c51006130370 ("fs/squashfs: new filesystem")
24+Upstream-commit: https://github.com/u-boot/u-boot/commit/561ae28cb56a082cfa90c1c421c4955bc215470b
25+Signed-off-by: Shahriyar Jalayeri <shahriyar@byteray.co.uk>
26+Reviewed-by: Richard Genoud <richard.genoud@bootlin.com>
27+---
28+ fs/squashfs/sqfs.c | 23 +++++++++++++++++++----
29+ 1 file changed, 19 insertions(+), 4 deletions(-)
30+ 
31+diff --git a/fs/squashfs/sqfs.c b/fs/squashfs/sqfs.c
32+index 0768fc4a7b28..3aadcdd36ecb 100644
33+--- a/fs/squashfs/sqfs.c
34++++ b/fs/squashfs/sqfs.c
35+@@ -852,13 +852,28 @@ static int sqfs_read_directory_table(unsigned char **dir_table, u32 **pos_list)
36+ if (metablks_count < 1)
37+ goto out;
38+
39+- *dir_table = malloc(metablks_count * SQFS_METADATA_BLOCK_SIZE);
40+- if (!*dir_table)
41++ if (__builtin_mul_overflow(metablks_count, SQFS_METADATA_BLOCK_SIZE,
42++ &buf_size)) {
43++ metablks_count = -1;
44++ goto out;
45++ }
46++
47++ *dir_table = malloc(buf_size);
48++ if (!*dir_table) {
49++ metablks_count = -1;
50++ goto out;
51++ }
52++
53++ if (__builtin_mul_overflow(metablks_count, sizeof(u32), &buf_size)) {
54++ metablks_count = -1;
55+ goto out;
56++ }
57+
58+- *pos_list = malloc(metablks_count * sizeof(u32));
59+- if (!*pos_list)
60++ *pos_list = malloc(buf_size);
61++ if (!*pos_list) {
62++ metablks_count = -1;
63+ goto out;
64++ }
65+
66+ ret = sqfs_get_metablk_pos(*pos_list, dtb, table_offset,
67+ metablks_count);
Muboot-tools.spec+7-1
@@ -3,7 +3,7 @@
3 3 
4Name: uboot-tools4Name: uboot-tools
5Version: 2024.015Version: 2024.01
6-Release: 66+Release: 8
7Summary: tools for U-Boot7Summary: tools for U-Boot
8License: GPL-2.0-or-later and Public Domain and GPL-2.0-only8License: GPL-2.0-or-later and Public Domain and GPL-2.0-only
9URL: http://www.denx.de/wiki/U-Boot9URL: http://www.denx.de/wiki/U-Boot
@@ -32,6 +32,8 @@ Patch18: backport-CVE-2026-29009.patch
32Patch19: backport-CVE-2026-74220.patch32Patch19: backport-CVE-2026-74220.patch
33Patch20: backport-0001-CVE-2026-74221.patch33Patch20: backport-0001-CVE-2026-74221.patch
34Patch21: backport-0002-CVE-2026-74221.patch34Patch21: backport-0002-CVE-2026-74221.patch
35+Patch26: backport-0001-CVE-2026-71973.patch
36+Patch27: backport-0002-CVE-2026-71973.patch
35 37 
36BuildRequires: bc dtc gcc make flex bison git-core openssl-devel38BuildRequires: bc dtc gcc make flex bison git-core openssl-devel
37BuildRequires: python3-unversioned-command python3-devel python3-setuptools39BuildRequires: python3-unversioned-command python3-devel python3-setuptools
@@ -236,6 +238,10 @@ install -p -m 0755 %{SOURCE2} %{buildroot}/lib/kernel/install.d/
236%{_mandir}/man1/mkimage.1*238%{_mandir}/man1/mkimage.1*
237 239 
238%changelog240%changelog
241+* Tue Nov 03 2026 infra_team <zhaiwenjie1@huawei.com> - 2024.01-8
242+- fix CVE-2026-71973
243+- backport fs/squashfs: fix integer overflow in directory table allocation
244+ 
239* Wed Oct 28 2026 lingsheng <ultra_planet@qq.com> - 2024.01-6245* Wed Oct 28 2026 lingsheng <ultra_planet@qq.com> - 2024.01-6
240- fix CVE-2026-74220 CVE-2026-74221246- fix CVE-2026-74220 CVE-2026-74221
241 247