diff options
| author | Jan Kara <jack@suse.cz> | 2014-12-19 12:03:53 +0100 |
|---|---|---|
| committer | Mister Oyster <oysterized@gmail.com> | 2017-04-29 21:23:48 +0200 |
| commit | 81e2f2306b07bd1cc8d9a715df0b4dc0588c0eba (patch) | |
| tree | 2ad0f3ddd6bb15231107a3e17d5693cf3115dd8d | |
| parent | 3e0e49ebddd860ad6cceca5868de4c96858154a2 (diff) | |
BACKPORT: [UPSTREAM] udf: Verify i_size when loading inode
(Cherry-pick from e159332b9af4b04d882dbcfe1bb0117f0a6d4b58)
Verify that inode size is sane when loading inode with data stored in
ICB. Otherwise we may get confused later when working with the inode and
inode size is too big.
CC: stable@vger.kernel.org
Reported-by: Carl Henrik Lunde <chlunde@ping.uio.no>
Signed-off-by: Jan Kara <jack@suse.cz>
Bug: 35808154
Change-Id: I96a40c26875d6efda3c62a27eb6a8b477a57ab4a
| -rw-r--r-- | fs/udf/inode.c | 14 |
1 files changed, 14 insertions, 0 deletions
diff --git a/fs/udf/inode.c b/fs/udf/inode.c index 5c1120a5f..9b318623d 100644 --- a/fs/udf/inode.c +++ b/fs/udf/inode.c @@ -1495,6 +1495,20 @@ static void udf_fill_inode(struct inode *inode, struct buffer_head *bh) iinfo->i_checkpoint = le32_to_cpu(efe->checkpoint); } + /* Sanity checks for files in ICB so that we don't get confused later */ + if (iinfo->i_alloc_type == ICBTAG_FLAG_AD_IN_ICB) { + /* + * For file in ICB data is stored in allocation descriptor + * so sizes should match + */ + if (iinfo->i_lenAlloc != inode->i_size) + goto out; + /* File in ICB has to fit in there... */ + if (inode->i_size > inode->i_sb->s_blocksize - + udf_file_entry_alloc_offset(inode)) + goto out; + } + /* * Sanity check length of allocation descriptors and extended attrs to * avoid integer overflows |