summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorJan Kara <jack@suse.cz>2018-06-13 13:09:22 +0300
committerJan Kara <jack@suse.cz>2018-06-20 12:05:31 +0300
commitfa65653e575fbd958bdf5fb9c4a71a324e39510d (patch)
treed4c72542efca534caea70cab397ccf4a35ea3c2a
parent27e6ed54a30a00d6520ddb4518214df8ff99daf1 (diff)
downloadlinux-fa65653e575fbd958bdf5fb9c4a71a324e39510d.tar.xz
udf: Detect incorrect directory size
Detect when a directory entry is (possibly partially) beyond directory size and return EIO in that case since it means the filesystem is corrupted. Otherwise directory operations can further corrupt the directory and possibly also oops the kernel. CC: Anatoly Trosinenko <anatoly.trosinenko@gmail.com> CC: stable@vger.kernel.org Reported-and-tested-by: Anatoly Trosinenko <anatoly.trosinenko@gmail.com> Signed-off-by: Jan Kara <jack@suse.cz>
-rw-r--r--fs/udf/directory.c3
1 files changed, 3 insertions, 0 deletions
diff --git a/fs/udf/directory.c b/fs/udf/directory.c
index 0a98a2369738..3835f983cc99 100644
--- a/fs/udf/directory.c
+++ b/fs/udf/directory.c
@@ -152,6 +152,9 @@ struct fileIdentDesc *udf_fileident_read(struct inode *dir, loff_t *nf_pos,
sizeof(struct fileIdentDesc));
}
}
+ /* Got last entry outside of dir size - fs is corrupted! */
+ if (*nf_pos > dir->i_size)
+ return NULL;
return fi;
}