| From | Sasha Levin <> | Subject | [PATCH AUTOSEL 4.14 092/170] udf: Fix BUG on corrupted inode | Date | Mon, 28 Jan 2019 11:10:42 -0500 |
| |
From: Jan Kara <jack@suse.cz>
[ Upstream commit d288d95842f1503414b7eebce3773bac3390457e ]
When inode is corrupted so that extent type is invalid, some functions (such as udf_truncate_extents()) will just BUG. Check that extent type is valid when loading the inode to memory.
Reported-by: Anatoly Trosinenko <anatoly.trosinenko@gmail.com> Signed-off-by: Jan Kara <jack@suse.cz> Signed-off-by: Sasha Levin <sashal@kernel.org> --- fs/udf/inode.c | 6 ++++++ 1 file changed, 6 insertions(+)
diff --git a/fs/udf/inode.c b/fs/udf/inode.c index 8dacf4f57414..28b9d7cca29b 100644 --- a/fs/udf/inode.c +++ b/fs/udf/inode.c @@ -1357,6 +1357,12 @@ static int udf_read_inode(struct inode *inode, bool hidden_inode) iinfo->i_alloc_type = le16_to_cpu(fe->icbTag.flags) & ICBTAG_FLAG_AD_MASK; + if (iinfo->i_alloc_type != ICBTAG_FLAG_AD_SHORT && + iinfo->i_alloc_type != ICBTAG_FLAG_AD_LONG && + iinfo->i_alloc_type != ICBTAG_FLAG_AD_IN_ICB) { + ret = -EIO; + goto out; + } iinfo->i_unique = 0; iinfo->i_lenEAttr = 0; iinfo->i_lenExtents = 0; -- 2.19.1
|