From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S932115AbbFQXAd (ORCPT ); Wed, 17 Jun 2015 19:00:33 -0400 Received: from youngberry.canonical.com ([91.189.89.112]:35474 "EHLO youngberry.canonical.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1750966AbbFQW3q (ORCPT ); Wed, 17 Jun 2015 18:29:46 -0400 From: Kamal Mostafa To: linux-kernel@vger.kernel.org, stable@vger.kernel.org, kernel-team@lists.ubuntu.com Cc: Jan Kara , Luis Henriques , Kamal Mostafa Subject: [PATCH 3.13.y-ckt 013/122] udf: Check length of extended attributes and allocation descriptors Date: Wed, 17 Jun 2015 15:27:20 -0700 Message-Id: <1434580149-3095-14-git-send-email-kamal@canonical.com> X-Mailer: git-send-email 1.9.1 In-Reply-To: <1434580149-3095-1-git-send-email-kamal@canonical.com> References: <1434580149-3095-1-git-send-email-kamal@canonical.com> X-Extended-Stable: 3.13 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org 3.13.11-ckt22 -stable review patch. If anyone has any objections, please let me know. ------------------ From: Jan Kara commit 23b133bdc452aa441fcb9b82cbf6dd05cfd342d0 upstream. Check length of extended attributes and allocation descriptors when loading inodes from disk. Otherwise corrupted filesystems could confuse the code and make the kernel oops. Reported-by: Carl Henrik Lunde Signed-off-by: Jan Kara Reference: CVE-2015-4167 BugLink: https://bugs.launchpad.net/bugs/1462173 [ luis: used Ben's backport to 3.16: - use make_bad_inode() instead of returning error ] Signed-off-by: Luis Henriques Signed-off-by: Kamal Mostafa --- fs/udf/inode.c | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/fs/udf/inode.c b/fs/udf/inode.c index 8aa2b1b..cfdbbfd 100644 --- a/fs/udf/inode.c +++ b/fs/udf/inode.c @@ -1480,6 +1480,19 @@ reread: iinfo->i_checkpoint = le32_to_cpu(efe->checkpoint); } + /* + * Sanity check length of allocation descriptors and extended attrs to + * avoid integer overflows + */ + if (iinfo->i_lenEAttr > bs || iinfo->i_lenAlloc > bs) { + make_bad_inode(inode); + return; + } + /* Now do exact checks */ + if (udf_file_entry_alloc_offset(inode) + iinfo->i_lenAlloc > bs) { + make_bad_inode(inode); + return; + } /* Sanity checks for files in ICB so that we don't get confused later */ if (iinfo->i_alloc_type == ICBTAG_FLAG_AD_IN_ICB) { /* -- 1.9.1