[PATCH 12/12 linux-next] udf: check partition reference in udf_read_inode()

From	Fabian Frederick <fabf@skynet.be>
Newsgroups	linux.kernel
Subject	[PATCH 12/12 linux-next] udf: check partition reference in udf_read_inode()
Date	2017-01-06 22:00 +0100
Message-ID	<sWJMd-7eR-1@gated-at.bofh.it> (permalink)
References	<sWJMd-7eR-3@gated-at.bofh.it> <sWJMd-7eR-5@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Show all headers | View raw

We were checking block number without checking partition.
sbi->s_partmaps[iloc->partitionReferenceNum] could lead to
bad memory access. See udf_nfs_get_inode() path for instance.

Signed-off-by: Fabian Frederick <fabf@skynet.be>
---
 fs/udf/inode.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/fs/udf/inode.c b/fs/udf/inode.c
index 47638eb..3926973 100644
--- a/fs/udf/inode.c
+++ b/fs/udf/inode.c
@@ -1276,6 +1276,12 @@ static int udf_read_inode(struct inode *inode, bool hidden_inode)
 	int ret = -EIO;
 
 reread:
+	if (iloc->partitionReferenceNum >= sbi->s_partitions) {
+		udf_debug("partition reference: %d > logical volume partitions: %d\n",
+			  iloc->partitionReferenceNum, sbi->s_partitions);
+		return -EIO;
+	}
+
 	if (iloc->logicalBlockNum >=
 	    sbi->s_partmaps[iloc->partitionReferenceNum].s_partition_len) {
 		udf_debug("block=%d, partition=%d out of range\n",
-- 
2.7.4

Back to linux.kernel | Previous | Next — Next in thread | Find similar | Unroll thread

Thread

[PATCH 12/12 linux-next] udf: check partition reference in udf_read_inode() Fabian Frederick <fabf@skynet.be> - 2017-01-06 22:00 +0100
  Re: [PATCH 12/12 linux-next] udf: check partition reference in  udf_read_inode() Jan Kara <jack@suse.cz> - 2017-01-10 12:00 +0100

csiph-web