udf: Limit sparing table size (44ac6b82) · Commits · 戴 / test

Although UDF standard allows it, we don't support sparing table larger than a single block. Check it during mount so that we don't try to access memory beyond end of buffer. Reported-by:

<syzbot+9991561e714f597095da@syzkaller.appspotmail.com> Signed-off-by:

Jan Kara <jack@suse.cz>

fs/udf/super.c

+6 −0

Original line number	Diff line number	Diff line
		@@ -1345,6 +1345,12 @@ static int udf_load_sparable_map(struct super_block *sb,
		(int)spm->numSparingTables);
		return -EIO;
		}
		if (le32_to_cpu(spm->sizeSparingTable) > sb->s_blocksize) {
		udf_err(sb, "error loading logical volume descriptor: "
		"Too big sparing table size (%u)\n",
		le32_to_cpu(spm->sizeSparingTable));
		return -EIO;
		}

		for (i = 0; i < spm->numSparingTables; i++) {
		loc = le32_to_cpu(spm->locSparingTable[i]);

Admin message