Patch "udf: Check length of extended attributes and allocation descriptors" has been added to the 3.10-stable tree

This is a note to let you know that I've just added the patch titled

udf: Check length of extended attributes and allocation descriptors

to the 3.10-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
udf-check-length-of-extended-attributes-and-allocation-descriptors.patch
and it can be found in the queue-3.10 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.

From: Jan Kara <[email protected]>
Date: Wed, 7 Jan 2015 13:49:08 +0100
Subject: udf: Check length of extended attributes and allocation descriptors

From: Jan Kara <[email protected]>

commit 23b133bdc452aa441fcb9b82cbf6dd05cfd342d0 upstream.

Check length of extended attributes and allocation descriptors when loading inodes from disk. Otherwise corrupted filesystems could confuse the code and make the kernel oops.

[Jan and Jiri fixed it in 3.12 stable, i ported it to 3.10 stable,
replaced bs by inode->i_sb->s_blocksize]

---
 fs/udf/inode.c |   10 ++++++++++
 1 file changed, 10 insertions(+)

@@ -1495,6 +1495,16 @@ static void udf_fill_inode(struct inode
 		iinfo->i_checkpoint = le32_to_cpu(efe->checkpoint);
 	}
 
+	/*
+	 * Sanity check length of allocation descriptors and extended attrs to
+	 * avoid integer overflows
+	 */
+	if (iinfo->i_lenEAttr > inode->i_sb->s_blocksize || iinfo->i_lenAlloc > inode->i_sb->s_blocksize)
+		return;
+	/* Now do exact checks */
+	if (udf_file_entry_alloc_offset(inode) + iinfo->i_lenAlloc > inode->i_sb->s_blocksize)
+		return;
+
 	switch (fe->icbTag.fileType) {
 	case ICBTAG_FILE_TYPE_DIRECTORY:
 		inode->i_op = &udf_dir_inode_operations;

Patches currently in stable-queue which might be from [email protected] are

queue-3.10/udf-check-length-of-extended-attributes-and-allocation-descriptors.patch