Commit fa65653e authored Jun 13, 2018 by Jan Kara

udf: Detect incorrect directory size



Detect when a directory entry is (possibly partially) beyond directory
size and return EIO in that case since it means the filesystem is
corrupted. Otherwise directory operations can further corrupt the
directory and possibly also oops the kernel.

CC: Anatoly Trosinenko <anatoly.trosinenko@gmail.com>
CC: stable@vger.kernel.org
Reported-and-tested-by: Anatoly Trosinenko <anatoly.trosinenko@gmail.com>
Signed-off-by: Jan Kara <jack@suse.cz>

parent 27e6ed54

fs/udf/directory.c

+3 −0

Original line number	Diff line number	Diff line
		@@ -152,6 +152,9 @@ struct fileIdentDesc udf_fileident_read(struct inode dir, loff_t *nf_pos,
		sizeof(struct fileIdentDesc));
		}
		}
		/* Got last entry outside of dir size - fs is corrupted! */
		if (*nf_pos > dir->i_size)
		return NULL;
		return fi;
		}

Admin message