Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1347719

[PATCH 3.10 31/80] mac: validate mac_partition is within sector

Show all headers | View raw

3.10-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Kees Cook <keescook@chromium.org>

commit 02e2a5bfebe99edcf9d694575a75032d53fe1b73 upstream.

If md->signature == MAC_DRIVER_MAGIC and md->block_size == 1023, a single
512 byte sector would be read (secsize / 512). However the partition
structure would be located past the end of the buffer (secsize % 512).

Signed-off-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Jens Axboe <axboe@fb.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 block/partitions/mac.c |   10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

--- a/block/partitions/mac.c
+++ b/block/partitions/mac.c
@@ -32,7 +32,7 @@ int mac_partition(struct parsed_partitio
 	Sector sect;
 	unsigned char *data;
 	int slot, blocks_in_map;
-	unsigned secsize;
+	unsigned secsize, datasize, partoffset;
 #ifdef CONFIG_PPC_PMAC
 	int found_root = 0;
 	int found_root_goodness = 0;
@@ -50,10 +50,14 @@ int mac_partition(struct parsed_partitio
 	}
 	secsize = be16_to_cpu(md->block_size);
 	put_dev_sector(sect);
-	data = read_part_sector(state, secsize/512, &sect);
+	datasize = round_down(secsize, 512);
+	data = read_part_sector(state, datasize / 512, &sect);
 	if (!data)
 		return -1;
-	part = (struct mac_partition *) (data + secsize%512);
+	partoffset = secsize % 512;
+	if (partoffset + sizeof(*part) > datasize)
+		return -1;
+	part = (struct mac_partition *) (data + partoffset);
 	if (be16_to_cpu(part->signature) != MAC_PARTITION_MAGIC) {
 		put_dev_sector(sect);
 		return 0;		/* not a MacOS disk */

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[PATCH 3.10 00/80] 3.10.99-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-03-02 03:40 +0100
  [PATCH 3.10 08/80] dm thin metadata: fix bug when taking a metadata snapshot Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-03-02 03:40 +0100
  [PATCH 3.10 02/80] drm/ast: Initialized data needed to map fbdev memory Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-03-02 03:40 +0100
  [PATCH 3.10 23/80] dts: vt8500: Add SDHC node to DTS file for WM8650 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-03-02 03:40 +0100
  [PATCH 3.10 07/80] efi: Disable interrupts around EFI calls, not in the epilog/prolog calls Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-03-02 03:40 +0100
  [PATCH 3.10 31/80] mac: validate mac_partition is within sector Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-03-02 03:40 +0100
  [PATCH 3.10 14/80] proc: Fix ptrace-based permission checks for accessing task maps Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-03-02 03:40 +0100
  [PATCH 3.10 29/80] megaraid_sas : SMAP restriction--do not access user memory from IOCTL code Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-03-02 03:40 +0100
  [PATCH 3.10 32/80] ARC: dw2 unwind: Remove falllback linear search thru FDE entries Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-03-02 03:40 +0100
  [PATCH 3.10 11/80] USB: cp210x: add IDs for GE B650V3 and B850V3 boards Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-03-02 03:40 +0100
  [PATCH 3.10 41/80] dm btree: fix bufio buffer leaks in dm_btree_del() error path Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-03-02 03:40 +0100
  [PATCH 3.10 27/80] wm831x_power: Use IRQF_ONESHOT to request threaded IRQs Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-03-02 03:40 +0100
  [PATCH 3.10 10/80] can: ems_usb: Fix possible tx overflow Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-03-02 03:40 +0100
  [PATCH 3.10 01/80] tracepoints: Do not trace when cpu is offline Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-03-02 03:40 +0100
  [PATCH 3.10 06/80] drm/radeon: fix hotplug race at startup Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-03-02 03:40 +0100
  [PATCH 3.10 26/80] devres: fix a for loop bounds check Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-03-02 03:40 +0100
  [PATCH 3.10 30/80] mmc: remove bondage between REQ_META and reliable write Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-03-02 03:40 +0100
  [PATCH 3.10 15/80] iw_cxgb3: Fix incorrectly returning error on success Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-03-02 03:40 +0100
  [PATCH 3.10 35/80] virtio: fix memory leak of virtio ida cache layers Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-03-02 03:40 +0100
  [PATCH 3.10 04/80] bcache: unregister reboot notifier if bcache fails to unregister device Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-03-02 03:50 +0100
  Re: [PATCH 3.10 00/80] 3.10.99-stable review Guenter Roeck <linux@roeck-us.net> - 2016-03-02 15:40 +0100
    Re: [PATCH 3.10 00/80] 3.10.99-stable review Willy Tarreau <w@1wt.eu> - 2016-03-02 16:50 +0100
      Re: [PATCH 3.10 00/80] 3.10.99-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-03-02 18:30 +0100

csiph-web