From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Jan Kara <jack@suse.cz>,
syzbot+7fbfe5fed73ebb675748@syzkaller.appspotmail.com,
Sasha Levin <sashal@kernel.org>
Subject: [PATCH AUTOSEL 4.9 06/14] udf: Check LVID earlier
Date: Sun, 5 Sep 2021 21:24:07 -0400 [thread overview]
Message-ID: <20210906012415.931147-6-sashal@kernel.org> (raw)
In-Reply-To: <20210906012415.931147-1-sashal@kernel.org>
From: Jan Kara <jack@suse.cz>
[ Upstream commit 781d2a9a2fc7d0be53a072794dc03ef6de770f3d ]
We were checking validity of LVID entries only when getting
implementation use information from LVID in udf_sb_lvidiu(). However if
the LVID is suitably corrupted, it can cause problems also to code such
as udf_count_free() which doesn't use udf_sb_lvidiu(). So check validity
of LVID already when loading it from the disk and just disable LVID
altogether when it is not valid.
Reported-by: syzbot+7fbfe5fed73ebb675748@syzkaller.appspotmail.com
Signed-off-by: Jan Kara <jack@suse.cz>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/udf/super.c | 25 ++++++++++++++++---------
1 file changed, 16 insertions(+), 9 deletions(-)
diff --git a/fs/udf/super.c b/fs/udf/super.c
index c8c037e8e57b..cf2e770080f9 100644
--- a/fs/udf/super.c
+++ b/fs/udf/super.c
@@ -115,16 +115,10 @@ struct logicalVolIntegrityDescImpUse *udf_sb_lvidiu(struct super_block *sb)
return NULL;
lvid = (struct logicalVolIntegrityDesc *)UDF_SB(sb)->s_lvid_bh->b_data;
partnum = le32_to_cpu(lvid->numOfPartitions);
- if ((sb->s_blocksize - sizeof(struct logicalVolIntegrityDescImpUse) -
- offsetof(struct logicalVolIntegrityDesc, impUse)) /
- (2 * sizeof(uint32_t)) < partnum) {
- udf_err(sb, "Logical volume integrity descriptor corrupted "
- "(numOfPartitions = %u)!\n", partnum);
- return NULL;
- }
/* The offset is to skip freeSpaceTable and sizeTable arrays */
offset = partnum * 2 * sizeof(uint32_t);
- return (struct logicalVolIntegrityDescImpUse *)&(lvid->impUse[offset]);
+ return (struct logicalVolIntegrityDescImpUse *)
+ (((uint8_t *)(lvid + 1)) + offset);
}
/* UDF filesystem type */
@@ -1571,6 +1565,7 @@ static void udf_load_logicalvolint(struct super_block *sb, struct kernel_extent_
struct udf_sb_info *sbi = UDF_SB(sb);
struct logicalVolIntegrityDesc *lvid;
int indirections = 0;
+ u32 parts, impuselen;
while (++indirections <= UDF_MAX_LVID_NESTING) {
final_bh = NULL;
@@ -1597,15 +1592,27 @@ static void udf_load_logicalvolint(struct super_block *sb, struct kernel_extent_
lvid = (struct logicalVolIntegrityDesc *)final_bh->b_data;
if (lvid->nextIntegrityExt.extLength == 0)
- return;
+ goto check;
loc = leea_to_cpu(lvid->nextIntegrityExt);
}
udf_warn(sb, "Too many LVID indirections (max %u), ignoring.\n",
UDF_MAX_LVID_NESTING);
+out_err:
brelse(sbi->s_lvid_bh);
sbi->s_lvid_bh = NULL;
+ return;
+check:
+ parts = le32_to_cpu(lvid->numOfPartitions);
+ impuselen = le32_to_cpu(lvid->lengthOfImpUse);
+ if (parts >= sb->s_blocksize || impuselen >= sb->s_blocksize ||
+ sizeof(struct logicalVolIntegrityDesc) + impuselen +
+ 2 * parts * sizeof(u32) > sb->s_blocksize) {
+ udf_warn(sb, "Corrupted LVID (parts=%u, impuselen=%u), "
+ "ignoring.\n", parts, impuselen);
+ goto out_err;
+ }
}
--
2.30.2
next prev parent reply other threads:[~2021-09-06 1:35 UTC|newest]
Thread overview: 14+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-09-06 1:24 [PATCH AUTOSEL 4.9 01/14] regmap: fix the offset of register error log Sasha Levin
2021-09-06 1:24 ` [PATCH AUTOSEL 4.9 02/14] crypto: mxs-dcp - Check for DMA mapping errors Sasha Levin
2021-09-06 1:24 ` [PATCH AUTOSEL 4.9 03/14] power: supply: axp288_fuel_gauge: Report register-address on readb / writeb errors Sasha Levin
2021-09-06 1:24 ` [PATCH AUTOSEL 4.9 04/14] crypto: omap-sham - clear dma flags only after omap_sham_update_dma_stop() Sasha Levin
2021-09-06 1:24 ` [PATCH AUTOSEL 4.9 05/14] posix-cpu-timers: Force next expiration recalc after itimer reset Sasha Levin
2021-09-06 1:24 ` Sasha Levin [this message]
2021-09-06 1:24 ` [PATCH AUTOSEL 4.9 07/14] power: supply: max17042_battery: fix typo in MAx17042_TOFF Sasha Levin
2021-09-06 1:24 ` [PATCH AUTOSEL 4.9 08/14] libata: fix ata_host_start() Sasha Levin
2021-09-06 1:24 ` [PATCH AUTOSEL 4.9 09/14] crypto: qat - do not ignore errors from enable_vf2pf_comms() Sasha Levin
2021-09-06 1:24 ` [PATCH AUTOSEL 4.9 10/14] crypto: qat - handle both source of interrupt in VF ISR Sasha Levin
2021-09-06 1:24 ` [PATCH AUTOSEL 4.9 11/14] crypto: qat - fix reuse of completion variable Sasha Levin
2021-09-06 1:24 ` [PATCH AUTOSEL 4.9 12/14] crypto: qat - fix naming for init/shutdown VF to PF notifications Sasha Levin
2021-09-06 1:24 ` [PATCH AUTOSEL 4.9 13/14] crypto: qat - do not export adf_iov_putmsg() Sasha Levin
2021-09-06 1:24 ` [PATCH AUTOSEL 4.9 14/14] udf_get_extendedattr() had no boundary checks Sasha Levin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20210906012415.931147-6-sashal@kernel.org \
--to=sashal@kernel.org \
--cc=jack@suse.cz \
--cc=linux-kernel@vger.kernel.org \
--cc=stable@vger.kernel.org \
--cc=syzbot+7fbfe5fed73ebb675748@syzkaller.appspotmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).