diff options
| author | Jan Kara <jack@suse.cz> | 2018-06-13 12:09:22 +0200 |
|---|---|---|
| committer | Ben Hutchings <ben@decadent.org.uk> | 2018-11-20 18:05:18 +0000 |
| commit | ca013e070697468a4b274a206959900bfaf41853 (patch) | |
| tree | 87512f81704321b05f55312f63f34ca556ac0e25 /fs | |
| parent | fa4e46ff5a97bbee5d1d018f1fb9954497f97cf0 (diff) | |
| download | linux-stable-ca013e070697468a4b274a206959900bfaf41853.tar.gz linux-stable-ca013e070697468a4b274a206959900bfaf41853.tar.bz2 linux-stable-ca013e070697468a4b274a206959900bfaf41853.zip | |
udf: Detect incorrect directory size
commit fa65653e575fbd958bdf5fb9c4a71a324e39510d upstream.
Detect when a directory entry is (possibly partially) beyond directory
size and return EIO in that case since it means the filesystem is
corrupted. Otherwise directory operations can further corrupt the
directory and possibly also oops the kernel.
CC: Anatoly Trosinenko <anatoly.trosinenko@gmail.com>
Reported-and-tested-by: Anatoly Trosinenko <anatoly.trosinenko@gmail.com>
Signed-off-by: Jan Kara <jack@suse.cz>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Diffstat (limited to 'fs')
| -rw-r--r-- | fs/udf/directory.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/fs/udf/directory.c b/fs/udf/directory.c index 3e44f575fb9c..f59003b1a40b 100644 --- a/fs/udf/directory.c +++ b/fs/udf/directory.c @@ -151,6 +151,9 @@ struct fileIdentDesc *udf_fileident_read(struct inode *dir, loff_t *nf_pos, sizeof(struct fileIdentDesc)); } } + /* Got last entry outside of dir size - fs is corrupted! */ + if (*nf_pos > dir->i_size) + return NULL; return fi; } |