This is a note to let you know that I've just added the patch titled
udf: Check length of extended attributes and allocation descriptors
to the 3.10-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
udf-check-length-of-extended-attributes-and-allocation-descriptors.patch
and it can be found in the queue-3.10 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <[email protected]> know about it.
>From 23b133bdc452aa441fcb9b82cbf6dd05cfd342d0 Mon Sep 17 00:00:00 2001
From: Jan Kara <[email protected]>
Date: Wed, 7 Jan 2015 13:49:08 +0100
Subject: udf: Check length of extended attributes and allocation descriptors
From: Jan Kara <[email protected]>
commit 23b133bdc452aa441fcb9b82cbf6dd05cfd342d0 upstream.
Check length of extended attributes and allocation descriptors when
loading inodes from disk. Otherwise corrupted filesystems could confuse
the code and make the kernel oops.
Reported-by: Carl Henrik Lunde <[email protected]>
Cc: [email protected]
Signed-off-by: Jan Kara <[email protected]>
Signed-off-by: Jiri Slaby <[email protected]>
[Jan and Jiri fixed it in 3.12 stable, i ported it to 3.10 stable,
replaced bs by inode->i_sb->s_blocksize]
Signed-off-by: Zhang Zhen <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
---
fs/udf/inode.c | 10 ++++++++++
1 file changed, 10 insertions(+)
--- a/fs/udf/inode.c
+++ b/fs/udf/inode.c
@@ -1495,6 +1495,16 @@ static void udf_fill_inode(struct inode
iinfo->i_checkpoint = le32_to_cpu(efe->checkpoint);
}
+ /*
+ * Sanity check length of allocation descriptors and extended attrs to
+ * avoid integer overflows
+ */
+ if (iinfo->i_lenEAttr > inode->i_sb->s_blocksize || iinfo->i_lenAlloc >
inode->i_sb->s_blocksize)
+ return;
+ /* Now do exact checks */
+ if (udf_file_entry_alloc_offset(inode) + iinfo->i_lenAlloc >
inode->i_sb->s_blocksize)
+ return;
+
switch (fe->icbTag.fileType) {
case ICBTAG_FILE_TYPE_DIRECTORY:
inode->i_op = &udf_dir_inode_operations;
Patches currently in stable-queue which might be from [email protected] are
queue-3.10/udf-check-length-of-extended-attributes-and-allocation-descriptors.patch
--
To unsubscribe from this list: send the line "unsubscribe stable" in
the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html
