Skip to contentSkip to conversation

udf: Avoid excessive partition lengths

PATCH In review Jan Kara 2 participants 3 messages Jun 20, 2024

Subsystems (2)
VFS UDF filesystem
lore
Share & tools
lore

Jan Kara

author reviewer
#0 lore raw

PATCH 1/1 udf: Avoid excessive partition lengths

Avoid mounting filesystems where the partition would overflow the 32-bits used for block number. Also refuse to mount filesystems where the partition length is so large we cannot safely index bits in a block bitmap.

Signed-off-by Jan Kara <[email protected]>
---
 fs/udf/super.c | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

I plan to merge this patch through my tree.

fs/udf/super.c +15 -0
index 9381a66c6ce5..c7bdda3f9369 100644
@@ -1110,12 +1110,19 @@ static int udf_fill_partdesc_info(struct super_block *sb,
 	struct udf_part_map *map;
 	struct udf_sb_info *sbi = UDF_SB(sb);
 	struct partitionHeaderDesc *phd;
+	u32 sum;
 	int err;
 
 	map = &sbi->s_partmaps[p_index];
 
 	map->s_partition_len = le32_to_cpu(p->partitionLength); /* blocks */
 	map->s_partition_root = le32_to_cpu(p->partitionStartingLocation);
+	if (check_add_overflow(map->s_partition_root, map->s_partition_len,
+			       &sum)) {
+		udf_err(sb, "Partition %d has invalid location %u + %u\n",
+			p_index, map->s_partition_root, map->s_partition_len);
+		return -EFSCORRUPTED;
+	}
 
 	if (p->accessType == cpu_to_le32(PD_ACCESS_TYPE_READ_ONLY))
 		map->s_partition_flags |= UDF_PART_FLAG_READ_ONLY;

@@ -1171,6 +1178,14 @@ static int udf_fill_partdesc_info(struct super_block *sb,
 		bitmap->s_extPosition = le32_to_cpu(
 				phd->unallocSpaceBitmap.extPosition);
 		map->s_partition_flags |= UDF_PART_FLAG_UNALLOC_BITMAP;
+		/* Check whether math over bitmap won't overflow. */
+		if (check_add_overflow(map->s_partition_len,
+				       sizeof(struct spaceBitmapDesc) << 3,
+				       &sum)) {
+			udf_err(sb, "Partition %d it too long (%u)\n", p_index,
+				map->s_partition_len);
+			return -EFSCORRUPTED;
+		}
 		udf_debug("unallocSpaceBitmap (part %d) @ %u\n",
 			  p_index, bitmap->s_extPosition);
 	}
Signature · 1 line
2.35.3
#1 lore raw

fs/udf/super.c static int udf_fill_partdesc_info(struct super_block *sb, · line 1186

Quoted 2 lines · Jan Kara
fs/udf/super.c +2 -0
+			udf_err(sb, "Partition %d it too long (%u)\n", p_index,
+				map->s_partition_len);

s/it/is/ ?

author reviewer
#2 lore raw
Quoted 5 lines · Matthew Wilcox

fs/udf/super.c static int udf_fill_partdesc_info(struct super_block *sb, · line 1186

Quoted 2 lines · Jan Kara
fs/udf/super.c +2 -0
+			udf_err(sb, "Partition %d it too long (%u)\n", p_index,
+				map->s_partition_len);

s/it/is/ ?

Yup, thanks!

Honza

Signature · 2 lines
Jan Kara <[email protected]>
SUSE Labs, CR