summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorFabian Frederick <fabf@skynet.be>2017-01-06 21:54:43 +0100
committerJan Kara <jack@suse.cz>2017-01-10 11:59:21 +0100
commit1d82a56bc5bf820b7c65d8130b44c0bc101b546c (patch)
tree6835a6658ddb237fe19aa2d88a7ab0c5a467eb7b
parent23bcda112f77da278898841615c7530c3e91a537 (diff)
downloadlinux-1d82a56bc5bf820b7c65d8130b44c0bc101b546c.tar.gz
linux-1d82a56bc5bf820b7c65d8130b44c0bc101b546c.tar.bz2
linux-1d82a56bc5bf820b7c65d8130b44c0bc101b546c.zip
udf: check partition reference in udf_read_inode()
We were checking block number without checking partition. sbi->s_partmaps[iloc->partitionReferenceNum] could lead to bad memory access. See udf_nfs_get_inode() path for instance. Signed-off-by: Fabian Frederick <fabf@skynet.be> Signed-off-by: Jan Kara <jack@suse.cz>
-rw-r--r--fs/udf/inode.c6
1 files changed, 6 insertions, 0 deletions
diff --git a/fs/udf/inode.c b/fs/udf/inode.c
index 2296c8708052..8ec6b3df0bc7 100644
--- a/fs/udf/inode.c
+++ b/fs/udf/inode.c
@@ -1277,6 +1277,12 @@ static int udf_read_inode(struct inode *inode, bool hidden_inode)
int ret = -EIO;
reread:
+ if (iloc->partitionReferenceNum >= sbi->s_partitions) {
+ udf_debug("partition reference: %d > logical volume partitions: %d\n",
+ iloc->partitionReferenceNum, sbi->s_partitions);
+ return -EIO;
+ }
+
if (iloc->logicalBlockNum >=
sbi->s_partmaps[iloc->partitionReferenceNum].s_partition_len) {
udf_debug("block=%d, partition=%d out of range\n",