Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1735505

[PATCH review for 4.4 25/47] partitions/efi: Fix integer overflow in GPT size calculation

From "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com>
Newsgroups linux.kernel
Subject [PATCH review for 4.4 25/47] partitions/efi: Fix integer overflow in GPT size calculation
Date 2017-09-20 07:10 +0200
Message-ID <urFqO-6Vo-13@gated-at.bofh.it> (permalink)
References <urF7r-6xD-3@gated-at.bofh.it>
Organization linux.* mail to news gateway

Show all headers | View raw

From: Alden Tondettar <alden.tondettar@gmail.com>

[ Upstream commit c5082b70adfe8e1ea1cf4a8eff92c9f260e364d2 ]

If a GUID Partition Table claims to have more than 2**25 entries, the
calculation of the partition table size in alloc_read_gpt_entries() will
overflow a 32-bit integer and not enough space will be allocated for the
table.

Nothing seems to get written out of bounds, but later efi_partition() will
read up to 32768 bytes from a 128 byte buffer, possibly OOPSing or exposing
information to /proc/partitions and uevents.

The problem exists on both 64-bit and 32-bit platforms.

Fix the overflow and also print a meaningful debug message if the table
size is too large.

Signed-off-by: Alden Tondettar <alden.tondettar@gmail.com>
Acked-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Signed-off-by: Jens Axboe <axboe@fb.com>
Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
---
 block/partitions/efi.c | 17 ++++++++++++-----
 1 file changed, 12 insertions(+), 5 deletions(-)

diff --git a/block/partitions/efi.c b/block/partitions/efi.c
index 26cb624ace05..d26d0d27f5fd 100644
--- a/block/partitions/efi.c
+++ b/block/partitions/efi.c
@@ -293,7 +293,7 @@ static gpt_entry *alloc_read_gpt_entries(struct parsed_partitions *state,
 	if (!gpt)
 		return NULL;
 
-	count = le32_to_cpu(gpt->num_partition_entries) *
+	count = (size_t)le32_to_cpu(gpt->num_partition_entries) *
                 le32_to_cpu(gpt->sizeof_partition_entry);
 	if (!count)
 		return NULL;
@@ -352,7 +352,7 @@ static int is_gpt_valid(struct parsed_partitions *state, u64 lba,
 			gpt_header **gpt, gpt_entry **ptes)
 {
 	u32 crc, origcrc;
-	u64 lastlba;
+	u64 lastlba, pt_size;
 
 	if (!ptes)
 		return 0;
@@ -434,13 +434,20 @@ static int is_gpt_valid(struct parsed_partitions *state, u64 lba,
 		goto fail;
 	}
 
+	/* Sanity check partition table size */
+	pt_size = (u64)le32_to_cpu((*gpt)->num_partition_entries) *
+		le32_to_cpu((*gpt)->sizeof_partition_entry);
+	if (pt_size > KMALLOC_MAX_SIZE) {
+		pr_debug("GUID Partition Table is too large: %llu > %lu bytes\n",
+			 (unsigned long long)pt_size, KMALLOC_MAX_SIZE);
+		goto fail;
+	}
+
 	if (!(*ptes = alloc_read_gpt_entries(state, *gpt)))
 		goto fail;
 
 	/* Check the GUID Partition Entry Array CRC */
-	crc = efi_crc32((const unsigned char *) (*ptes),
-			le32_to_cpu((*gpt)->num_partition_entries) *
-			le32_to_cpu((*gpt)->sizeof_partition_entry));
+	crc = efi_crc32((const unsigned char *) (*ptes), pt_size);
 
 	if (crc != le32_to_cpu((*gpt)->partition_entry_array_crc32)) {
 		pr_debug("GUID Partitition Entry Array CRC check failed.\n");
-- 
2.11.0

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[PATCH review for 4.4 01/47] drm_fourcc: Fix DRM_FORMAT_MOD_LINEAR  #define "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-09-20 07:10 +0200
  [PATCH review for 4.4 19/47] IB/ipoib: rtnl_unlock can not come after  free_netdev "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-09-20 07:10 +0200
  [PATCH review for 4.4 35/47] mmc: sdio: fix alignment issue in struct  sdio_func "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-09-20 07:10 +0200
  [PATCH review for 4.4 37/47] netfilter: invoke synchronize_rcu after  set the _hook_ to NULL "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-09-20 07:10 +0200
  [PATCH review for 4.4 11/47] sh_eth: use correct name for ECMR_MPDE  bit "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-09-20 07:10 +0200
  [PATCH review for 4.4 21/47] drm/amdkfd: fix improper return value on  error "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-09-20 07:10 +0200
  [PATCH review for 4.4 25/47] partitions/efi: Fix integer overflow in  GPT size calculation "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-09-20 07:10 +0200
  [PATCH review for 4.4 15/47] iio: adc: hx711: Add DT binding for  avia,hx711 "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-09-20 07:10 +0200
  [PATCH review for 4.4 22/47] USB: serial: mos7720: fix  control-message error handling "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-09-20 07:10 +0200
  [PATCH review for 4.4 14/47] iio: adc: axp288: Drop bogus  AXP288_ADC_TS_PIN_CTRL register modifications "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-09-20 07:10 +0200
  [PATCH review for 4.4 08/47] MIPS: ralink: Fix incorrect assignment  on ralink_soc "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-09-20 07:10 +0200
  [PATCH review for 4.4 04/47] RDS: RDMA: Fix the composite message  user notification "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-09-20 07:10 +0200
  [PATCH review for 4.4 12/47] clk: wm831x: fix usleep_range with bad  range "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-09-20 07:10 +0200
    Re: [PATCH review for 4.4 12/47] clk: wm831x: fix usleep_range with  bad range Charles Keepax <ckeepax@opensource.cirrus.com> - 2017-09-22 10:50 +0200
      Re: [PATCH review for 4.4 12/47] clk: wm831x: fix usleep_range with  bad range "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-09-24 02:20 +0200
  [PATCH review for 4.4 02/47] drm: bridge: add DT bindings for TI  ths8135 "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-09-20 07:10 +0200
  [PATCH review for 4.4 28/47] usb: chipidea: vbus event may exist  before starting gadget "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-09-20 07:10 +0200
  [PATCH review for 4.4 13/47] hwmon: (gl520sm) Fix overflows and crash  seen when writing into limit attributes "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-09-20 07:10 +0200
  [PATCH review for 4.4 40/47] netfilter: nfnl_cthelper: fix incorrect  helper->expect_class_max "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-09-20 07:10 +0200
  [PATCH review for 4.4 05/47] ARM: dts: r8a7790: Use R-Car Gen 2  fallback binding for msiof nodes "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-09-20 07:10 +0200
  [PATCH review for 4.4 18/47] IB/ipoib: Fix deadlock over vlan_mutex "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-09-20 07:10 +0200

csiph-web