udf: Fix off-by-one in volume descriptor sequence length (91c9c9ec) · Commits · 戴 / test

We pass one block beyond end of volume descriptor sequence into process_sequence() as 'lastblock' instead of the last block of the sequence. When the sequence is not terminated with TD descriptor, this could lead to false errors due to invalid blocks in volume descriptor sequence and thus unmountable volumes. Acked-by:

Pali Rohár <pali.rohar@gmail.com> Signed-off-by:

Jan Kara <jack@suse.cz>

fs/udf/super.c

+3 −3

Original line number	Diff line number	Diff line
		@@ -1658,7 +1658,7 @@ static noinline int udf_process_sequence(
		next_e = le32_to_cpu(
		vdp->nextVolDescSeqExt.extLength);
		next_e = next_e >> sb->s_blocksize_bits;
		next_e += next_s;
		next_e += next_s - 1;
		}
		break;
		case TAG_IDENT_IUVD: /* ISO 13346 3/10.4 */
		@@ -1760,13 +1760,13 @@ static int udf_load_sequence(struct super_block sb, struct buffer_head bh,
		main_s = le32_to_cpu(anchor->mainVolDescSeqExt.extLocation);
		main_e = le32_to_cpu(anchor->mainVolDescSeqExt.extLength);
		main_e = main_e >> sb->s_blocksize_bits;
		main_e += main_s;
		main_e += main_s - 1;

		/* Locate the reserve sequence */
		reserve_s = le32_to_cpu(anchor->reserveVolDescSeqExt.extLocation);
		reserve_e = le32_to_cpu(anchor->reserveVolDescSeqExt.extLength);
		reserve_e = reserve_e >> sb->s_blocksize_bits;
		reserve_e += reserve_s;
		reserve_e += reserve_s - 1;

		/* Process the main & reserve sequences */
		/* responsible for finding the PartitionDesc(s) */

Admin message