lkml.org 
[lkml]   [2015]   [May]   [4]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Date
    Subject[PATCH 3.2 006/221] udf: Check length of extended attributes and allocation descriptors
    3.2.69-rc1 review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Jan Kara <jack@suse.cz>

    commit 23b133bdc452aa441fcb9b82cbf6dd05cfd342d0 upstream.

    Check length of extended attributes and allocation descriptors when
    loading inodes from disk. Otherwise corrupted filesystems could confuse
    the code and make the kernel oops.

    Reported-by: Carl Henrik Lunde <chlunde@ping.uio.no>
    Signed-off-by: Jan Kara <jack@suse.cz>
    [bwh: Backported to 3.16: use make_bad_inode() instead of returning error]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    ---
    fs/udf/inode.c | 9 +++++++++
    1 file changed, 9 insertions(+)

    --- a/fs/udf/inode.c
    +++ b/fs/udf/inode.c
    @@ -1401,6 +1401,19 @@ static void udf_fill_inode(struct inode
    iinfo->i_lenEAttr;
    }

    + /*
    + * Sanity check length of allocation descriptors and extended attrs to
    + * avoid integer overflows
    + */
    + if (iinfo->i_lenEAttr > bs || iinfo->i_lenAlloc > bs) {
    + make_bad_inode(inode);
    + return;
    + }
    + /* Now do exact checks */
    + if (udf_file_entry_alloc_offset(inode) + iinfo->i_lenAlloc > bs) {
    + make_bad_inode(inode);
    + return;
    + }
    /* Sanity checks for files in ICB so that we don't get confused later */
    if (iinfo->i_alloc_type == ICBTAG_FLAG_AD_IN_ICB) {
    /*


    \
     
     \ /
      Last update: 2015-05-05 05:01    [W:4.254 / U:1.940 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site