Kernel/linux-next
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git synced 2025-01-11 16:29:05 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

hpfs: better test for errors

Browse Source 
The test if bitmap access is out of bound could errorneously pass if the
device size is divisible by 16384 sectors and we are asking for one bitmap
after the end.

Check for invalid size in the superblock. Invalid size could cause integer
overflows in the rest of the code.

Signed-off-by: Mikulas Patocka <mpatocka@artax.karlin.mff.cuni.cz>
Cc: stable@kernel.org
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
This commit is contained in:
Mikulas Patocka 2013-07-04 18:42:29 +02:00 committed by Linus Torvalds
parent 8bb495e3f0
commit 3ebacb0504
2 changed files with 9 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
fs/hpfs/map.c
View File

@ -17,7 +17,8 @@ __le32 *hpfs_map_bitmap(struct super_block *s, unsigned bmp_block,
struct quad_buffer_head *qbh, char *id) struct quad_buffer_head *qbh, char *id)
{ {
secno sec; secno sec;
if (hpfs_sb(s)->sb_chk) if (bmp_block * 16384 > hpfs_sb(s)->sb_fs_size) { unsigned n_bands = (hpfs_sb(s)->sb_fs_size + 0x3fff) >> 14;
if (hpfs_sb(s)->sb_chk) if (bmp_block >= n_bands) {
hpfs_error(s, "hpfs_map_bitmap called with bad parameter: %08x at %s", bmp_block, id); hpfs_error(s, "hpfs_map_bitmap called with bad parameter: %08x at %s", bmp_block, id);
return NULL; return NULL;
} }

8
fs/hpfs/super.c
View File

@ -558,7 +558,13 @@ static int hpfs_fill_super(struct super_block *s, void *options, int silent)
sbi->sb_cp_table = NULL; sbi->sb_cp_table = NULL;
sbi->sb_c_bitmap = -1; sbi->sb_c_bitmap = -1;
sbi->sb_max_fwd_alloc = 0xffffff; sbi->sb_max_fwd_alloc = 0xffffff;
if (sbi->sb_fs_size >= 0x80000000) {
hpfs_error(s, "invalid size in superblock: %08x",
(unsigned)sbi->sb_fs_size);
goto bail4;
}
/* Load bitmap directory */ /* Load bitmap directory */
if (!(sbi->sb_bmp_dir = hpfs_load_bitmap_directory(s, le32_to_cpu(superblock->bitmaps)))) if (!(sbi->sb_bmp_dir = hpfs_load_bitmap_directory(s, le32_to_cpu(superblock->bitmaps))))
goto bail4; goto bail4;