summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorMikulas Patocka <mikulas@artax.karlin.mff.cuni.cz>2013-07-04 18:42:29 +0200
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>2013-07-13 11:42:26 -0700
commit70621db0945635044214766b42e2dfca0d673929 (patch)
tree4bc3d490032f33a501743bf55c3c5d1ae8a3de6d
parente64c7e14f5dcb917a06fb39d5331ab88433fcaa7 (diff)
downloadlinux-3.10-70621db0945635044214766b42e2dfca0d673929.tar.gz
linux-3.10-70621db0945635044214766b42e2dfca0d673929.tar.bz2
linux-3.10-70621db0945635044214766b42e2dfca0d673929.zip
hpfs: better test for errors
commit 3ebacb05044f82c5f0bb456a894eb9dc57d0ed90 upstream. The test if bitmap access is out of bound could errorneously pass if the device size is divisible by 16384 sectors and we are asking for one bitmap after the end. Check for invalid size in the superblock. Invalid size could cause integer overflows in the rest of the code. Signed-off-by: Mikulas Patocka <mpatocka@artax.karlin.mff.cuni.cz> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-rw-r--r--fs/hpfs/map.c3
-rw-r--r--fs/hpfs/super.c8
2 files changed, 9 insertions, 2 deletions
diff --git a/fs/hpfs/map.c b/fs/hpfs/map.c
index 4acb19d7835..803d3da3a0f 100644
--- a/fs/hpfs/map.c
+++ b/fs/hpfs/map.c
@@ -17,7 +17,8 @@ __le32 *hpfs_map_bitmap(struct super_block *s, unsigned bmp_block,
struct quad_buffer_head *qbh, char *id)
{
secno sec;
- if (hpfs_sb(s)->sb_chk) if (bmp_block * 16384 > hpfs_sb(s)->sb_fs_size) {
+ unsigned n_bands = (hpfs_sb(s)->sb_fs_size + 0x3fff) >> 14;
+ if (hpfs_sb(s)->sb_chk) if (bmp_block >= n_bands) {
hpfs_error(s, "hpfs_map_bitmap called with bad parameter: %08x at %s", bmp_block, id);
return NULL;
}
diff --git a/fs/hpfs/super.c b/fs/hpfs/super.c
index a0617e70695..962e90c37ae 100644
--- a/fs/hpfs/super.c
+++ b/fs/hpfs/super.c
@@ -558,7 +558,13 @@ static int hpfs_fill_super(struct super_block *s, void *options, int silent)
sbi->sb_cp_table = NULL;
sbi->sb_c_bitmap = -1;
sbi->sb_max_fwd_alloc = 0xffffff;
-
+
+ if (sbi->sb_fs_size >= 0x80000000) {
+ hpfs_error(s, "invalid size in superblock: %08x",
+ (unsigned)sbi->sb_fs_size);
+ goto bail4;
+ }
+
/* Load bitmap directory */
if (!(sbi->sb_bmp_dir = hpfs_load_bitmap_directory(s, le32_to_cpu(superblock->bitmaps))))
goto bail4;