From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751327AbdAQQDT (ORCPT ); Tue, 17 Jan 2017 11:03:19 -0500 Received: from mail-pg0-f54.google.com ([74.125.83.54]:33332 "EHLO mail-pg0-f54.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751205AbdAQQDR (ORCPT ); Tue, 17 Jan 2017 11:03:17 -0500 Subject: Re: [PATCH] partitions/efi: Fix integer overflow in GPT size calculation To: Alden Tondettar , Davidlohr Bueso , linux-efi@vger.kernel.org, linux-block@vger.kernel.org, linux-kernel@vger.kernel.org References: <1484519516-18295-1-git-send-email-alden.tondettar@gmail.com> From: Jens Axboe Message-ID: <3c9bc8f7-7fb8-64d7-f195-7aadfd2cbb14@kernel.dk> Date: Tue, 17 Jan 2017 08:03:14 -0800 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Thunderbird/45.5.1 MIME-Version: 1.0 In-Reply-To: <1484519516-18295-1-git-send-email-alden.tondettar@gmail.com> Content-Type: text/plain; charset=windows-1252 Content-Transfer-Encoding: 7bit Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On 01/15/2017 02:31 PM, Alden Tondettar wrote: > If a GUID Partition Table claims to have more than 2**25 entries, the > calculation of the partition table size in alloc_read_gpt_entries() will > overflow a 32-bit integer and not enough space will be allocated for the > table. > > Nothing seems to get written out of bounds, but later efi_partition() will > read up to 32768 bytes from a 128 byte buffer, possibly OOPSing or exposing > information to /proc/partitions and uevents. > > The problem exists on both 64-bit and 32-bit platforms. > > Fix the overflow and also print a meaningful debug message if the table > size is too large. Applied for 4.11, thanks. -- Jens Axboe