lkml.org 
[lkml]   [2015]   [Sep]   [15]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 3.4 133/146] udf: Check length of extended attributes and allocation descriptors
    Date
    From: Jan Kara <jack@suse.cz>

    3.4.109-rc1 review patch. If anyone has any objections, please let me know.

    ------------------


    commit 23b133bdc452aa441fcb9b82cbf6dd05cfd342d0 upstream.

    Check length of extended attributes and allocation descriptors when
    loading inodes from disk. Otherwise corrupted filesystems could confuse
    the code and make the kernel oops.

    Reported-by: Carl Henrik Lunde <chlunde@ping.uio.no>
    Signed-off-by: Jan Kara <jack@suse.cz>
    [lizf: Backported to 3.4:
    - call make_bad_inode() and then return
    - relace bs with inode->i_sb->s_blocksize]
    Signed-off-by: Zefan Li <lizefan@huawei.com>
    ---
    fs/udf/inode.c | 13 +++++++++++++
    1 file changed, 13 insertions(+)

    diff --git a/fs/udf/inode.c b/fs/udf/inode.c
    index 8053ee7..330ec8c 100644
    --- a/fs/udf/inode.c
    +++ b/fs/udf/inode.c
    @@ -1392,6 +1392,19 @@ static void udf_fill_inode(struct inode *inode, struct buffer_head *bh)
    iinfo->i_lenEAttr;
    }

    + /*
    + * Sanity check length of allocation descriptors and extended attrs to
    + * avoid integer overflows
    + */
    + if (iinfo->i_lenEAttr > inode->i_sb->s_blocksize || iinfo->i_lenAlloc > inode->i_sb->s_blocksize) {
    + make_bad_inode(inode);
    + return;
    + }
    + /* Now do exact checks */
    + if (udf_file_entry_alloc_offset(inode) + iinfo->i_lenAlloc > inode->i_sb->s_blocksize) {
    + make_bad_inode(inode);
    + return;
    + }
    /* Sanity checks for files in ICB so that we don't get confused later */
    if (iinfo->i_alloc_type == ICBTAG_FLAG_AD_IN_ICB) {
    /*
    --
    1.9.1


    \
     
     \ /
      Last update: 2015-09-15 11:21    [W:4.156 / U:0.068 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site