isofs: Fix infinite looping over CE entries (f54e18f1) · Commits · 戴 / test

Rock Ridge extensions define so called Continuation Entries (CE) which define where is further space with Rock Ridge data. Corrupted isofs image can contain arbitrarily long chain of these, including a one containing loop and thus causing kernel to end in an infinite loop when traversing these entries. Limit the traversal to 32 entries which should be more than enough space to store all the Rock Ridge data. Reported-by:

P J P <ppandit@redhat.com> CC: stable@vger.kernel.org Signed-off-by:

Jan Kara <jack@suse.cz>

fs/isofs/rock.c

+6 −0

Original line number	Diff line number	Diff line
		@@ -30,6 +30,7 @@ struct rock_state {
		int cont_size;
		int cont_extent;
		int cont_offset;
		int cont_loops;
		struct inode *inode;
		};

		@@ -73,6 +74,9 @@ static void init_rock_state(struct rock_state rs, struct inode inode)
		rs->inode = inode;
		}

		/* Maximum number of Rock Ridge continuation entries */
		#define RR_MAX_CE_ENTRIES 32

		/*
		* Returns 0 if the caller should continue scanning, 1 if the scan must end
		* and -ve on error.
		@@ -105,6 +109,8 @@ static int rock_continue(struct rock_state *rs)
		goto out;
		}
		ret = -EIO;
		if (++rs->cont_loops >= RR_MAX_CE_ENTRIES)
		goto out;
		bh = sb_bread(rs->inode->i_sb, rs->cont_extent);
		if (bh) {
		memcpy(rs->buffer, bh->b_data + rs->cont_offset,

Admin message