Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 417bd613 authored by Gianfranco Trad's avatar Gianfranco Trad Committed by Greg Kroah-Hartman
Browse files

udf: fix uninit-value use in udf_get_fileshortad 

[ Upstream commit 264db9d666ad9a35075cc9ed9ec09d021580fbb1 ]

Check for overflow when computing alen in udf_current_aext to mitigate
later uninit-value use in udf_get_fileshortad KMSAN bug[1].
After applying the patch reproducer did not trigger any issue[2].

[1] https://syzkaller.appspot.com/bug?extid=8901c4560b7ab5c2f9df
[2] https://syzkaller.appspot.com/x/log.txt?x=10242227980000



Reported-by: default avatar <syzbot+8901c4560b7ab5c2f9df@syzkaller.appspotmail.com>
Closes: https://syzkaller.appspot.com/bug?extid=8901c4560b7ab5c2f9df


Tested-by: default avatar <syzbot+8901c4560b7ab5c2f9df@syzkaller.appspotmail.com>
Suggested-by: default avatarJan Kara <jack@suse.com>
Signed-off-by: default avatarGianfranco Trad <gianf.trad@gmail.com>
Signed-off-by: default avatarJan Kara <jack@suse.cz>
Link: https://patch.msgid.link/20240925074613.8475-3-gianf.trad@gmail.com


Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
parent 02c86c5d

fs/udf/inode.c

+6 −3
Original line number Diff line number Diff line
@@ -2193,12 +2193,15 @@ int8_t udf_current_aext(struct inode *inode, struct extent_position *epos, 
		alen = udf_file_entry_alloc_offset(inode) +

							iinfo->i_lenAlloc;

	} else {

		struct allocExtDesc *header =

			(struct allocExtDesc *)epos->bh->b_data;



		if (!epos->offset)

			epos->offset = sizeof(struct allocExtDesc);

		ptr = epos->bh->b_data + epos->offset;

		alen = sizeof(struct allocExtDesc) +

			le32_to_cpu(((struct allocExtDesc *)epos->bh->b_data)->

							lengthAllocDescs);

		if (check_add_overflow(sizeof(struct allocExtDesc),

				le32_to_cpu(header->lengthAllocDescs), &alen))

			return -1;

	}



	switch (iinfo->i_alloc_type) {