aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorJan Kara <jack@suse.cz>2018-06-13 12:09:22 +0200
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>2018-07-03 11:25:03 +0200
commit1b241aa840df5c7af16eb1ad0b614a372a639caa (patch)
tree5b0c8d863a1b5ae4f61039d978160d3556871614
parentd08dfdeaf49d240674fff55189a0d8349aeb0858 (diff)
udf: Detect incorrect directory size
commit fa65653e575fbd958bdf5fb9c4a71a324e39510d upstream. Detect when a directory entry is (possibly partially) beyond directory size and return EIO in that case since it means the filesystem is corrupted. Otherwise directory operations can further corrupt the directory and possibly also oops the kernel. CC: Anatoly Trosinenko <anatoly.trosinenko@gmail.com> CC: stable@vger.kernel.org Reported-and-tested-by: Anatoly Trosinenko <anatoly.trosinenko@gmail.com> Signed-off-by: Jan Kara <jack@suse.cz> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-rw-r--r--fs/udf/directory.c3
1 files changed, 3 insertions, 0 deletions
diff --git a/fs/udf/directory.c b/fs/udf/directory.c
index 7aa48bd7cbaf..a636b3b17219 100644
--- a/fs/udf/directory.c
+++ b/fs/udf/directory.c
@@ -151,6 +151,9 @@ struct fileIdentDesc *udf_fileident_read(struct inode *dir, loff_t *nf_pos,
sizeof(struct fileIdentDesc));
}
}
+ /* Got last entry outside of dir size - fs is corrupted! */
+ if (*nf_pos > dir->i_size)
+ return NULL;
return fi;
}