Re: Unlinking a file on a broken UDF image causes kernel BUG

Re: Unlinking a file on a broken UDF image causes kernel BUG

[Jan Kara]

[-- Attachment #1: Type: text/plain, Size: 772 bytes --]

Hi,

On Sun 14-10-18 18:27:25, Anatoly Trosinenko wrote:
> When unlinking a file on a fuzzed UDF image, the kernel BUG is triggered.
> 
> How to reproduce (with kvm-xfstests):
> 
> 1) Checkout udf/for_next (commit 3df77b04f)
> 2) Copy x86_64-config-4.14 to .config, execute `make olddefconfig`,
> then enable UDF support and compile the kernel
> 3) Copy the attached reproducer to
> /tmp/kvm-xfstests-$USER/dump_udf.img (1 Mb uncompressed)
> 4) Run `kvm-xfstests shell`
> 5) Inside the shell:

Thanks for report and sorry it took so long for me to get to this. Attached
patch fixes the issue for me.

Unless someone objects, I'm going to merge the patch to my tree and push it
to Linus in the coming merge window.

								Honza
-- 
Jan Kara <jack@suse.com>
SUSE Labs, CR

[-- Attachment #2: 0001-udf-Fix-BUG-on-corrupted-inode.patch --]
[-- Type: text/x-patch, Size: 1124 bytes --]

>From d524d42ca22801418c3f2c1cb1bf6e79c1ee217c Mon Sep 17 00:00:00 2001
From: Jan Kara <jack@suse.cz>
Date: Wed, 12 Dec 2018 14:29:20 +0100
Subject: [PATCH] udf: Fix BUG on corrupted inode

When inode is corrupted so that extent type is invalid, some functions
(such as udf_truncate_extents()) will just BUG. Check that extent type
is valid when loading the inode to memory.

Reported-by: Anatoly Trosinenko <anatoly.trosinenko@gmail.com>
Signed-off-by: Jan Kara <jack@suse.cz>
---
 fs/udf/inode.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/fs/udf/inode.c b/fs/udf/inode.c
index 5df554a9f9c9..ae796e10f68b 100644
--- a/fs/udf/inode.c
+++ b/fs/udf/inode.c
@@ -1357,6 +1357,12 @@ static int udf_read_inode(struct inode *inode, bool hidden_inode)
 
 	iinfo->i_alloc_type = le16_to_cpu(fe->icbTag.flags) &
 							ICBTAG_FLAG_AD_MASK;
+	if (iinfo->i_alloc_type != ICBTAG_FLAG_AD_SHORT &&
+	    iinfo->i_alloc_type != ICBTAG_FLAG_AD_LONG &&
+	    iinfo->i_alloc_type != ICBTAG_FLAG_AD_IN_ICB) {
+		ret = -EIO;
+		goto out;
+	}
 	iinfo->i_unique = 0;
 	iinfo->i_lenEAttr = 0;
 	iinfo->i_lenExtents = 0;
-- 
2.16.4