Unverified Commit de626630 authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!11735 fix CVE-2024-46777 for SP1 

Merge Pull Request from: @ci-robot 
 
PR sync from: Wupeng Ma <mawupeng1@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/VIPNWWBW2AGM2OEEITLGS4YM73Q63M2X/ 
From: Ma Wupeng <mawupeng1@huawei.com>

fix CVE-2024-46777 for SP1.

Jan Kara (2):
  udf: Define EFSCORRUPTED error code
  udf: Avoid excessive partition lengths


-- 
2.25.1
 
https://gitee.com/src-openeuler/kernel/issues/IARX38 
 
Link:https://gitee.com/openeuler/kernel/pulls/11735

 

Reviewed-by: default avatarYang Yingliang <yangyingliang@huawei.com>
Signed-off-by: default avatarYang Yingliang <yangyingliang@huawei.com>
parents 7cb20f21 622c171a

fs/udf/super.c

+15 −0
Original line number Diff line number Diff line
@@ -1074,12 +1074,19 @@ static int udf_fill_partdesc_info(struct super_block *sb, 
	struct udf_part_map *map;

	struct udf_sb_info *sbi = UDF_SB(sb);

	struct partitionHeaderDesc *phd;

	u32 sum;

	int err;



	map = &sbi->s_partmaps[p_index];



	map->s_partition_len = le32_to_cpu(p->partitionLength); /* blocks */

	map->s_partition_root = le32_to_cpu(p->partitionStartingLocation);

	if (check_add_overflow(map->s_partition_root, map->s_partition_len,

			       &sum)) {

		udf_err(sb, "Partition %d has invalid location %u + %u\n",

			p_index, map->s_partition_root, map->s_partition_len);

		return -EFSCORRUPTED;

	}



	if (p->accessType == cpu_to_le32(PD_ACCESS_TYPE_READ_ONLY))

		map->s_partition_flags |= UDF_PART_FLAG_READ_ONLY;
@@ -1135,6 +1142,14 @@ static int udf_fill_partdesc_info(struct super_block *sb, 
		bitmap->s_extPosition = le32_to_cpu(

				phd->unallocSpaceBitmap.extPosition);

		map->s_partition_flags |= UDF_PART_FLAG_UNALLOC_BITMAP;

		/* Check whether math over bitmap won't overflow. */

		if (check_add_overflow(map->s_partition_len,

				       (__u32)(sizeof(struct spaceBitmapDesc) << 3),

				       &sum)) {

			udf_err(sb, "Partition %d is too long (%u)\n", p_index,

				map->s_partition_len);

			return -EFSCORRUPTED;

		}

		udf_debug("unallocSpaceBitmap (part %d) @ %u\n",

			  p_index, bitmap->s_extPosition);

	}

fs/udf/udf_sb.h

+2 −0
Original line number Diff line number Diff line
@@ -51,6 +51,8 @@ 
#define MF_DUPLICATE_MD		0x01

#define MF_MIRROR_FE_LOADED	0x02



#define EFSCORRUPTED EUCLEAN



struct udf_meta_data {

	__u32	s_meta_file_loc;

	__u32	s_mirror_file_loc;