Re: [PATCH] Squashfs: check block offset is not negative

[Andrew Morton]

On Tue,  4 Aug 2026 20:40:37 +0100 Phillip Lougher <phillip@xxxxxxxxxxxxxxx> wrote:

> If a negative offset is read off disk (for example the offset into the
> decompressed fragment block), this will cause squashfs_copy_data() to
> perform an out of bounds access.
> 
> Fix by checking if offset is negative, and returning 0.  This matches
> existing behaviour where an offset beyond the block returns 0 bytes
> copied.
> 
> Fixes: f400e12656ab ("Squashfs: cache operations")

I agree with your removal of cc:stable.  "crafted image requires
CAP_SYS_ADMIN" isn't a thing we should bother backporting.

It's worth mentioning this in the changelog - let's please develop the
habit of describing the userspace-visible impact of bugs when we fix
them.