udf: Fix BUG on corrupted inode



When inode is corrupted so that extent type is invalid, some functions
(such as udf_truncate_extents()) will just BUG. Check that extent type
is valid when loading the inode to memory.

Reported-by: Anatoly Trosinenko <anatoly.trosinenko@gmail.com>
Signed-off-by: Jan Kara <jack@suse.cz>

parent 3e159b95

fs/udf/inode.c

+6 −0

Original line number	Diff line number	Diff line
		@@ -1357,6 +1357,12 @@ static int udf_read_inode(struct inode *inode, bool hidden_inode)

		iinfo->i_alloc_type = le16_to_cpu(fe->icbTag.flags) &
		ICBTAG_FLAG_AD_MASK;
		if (iinfo->i_alloc_type != ICBTAG_FLAG_AD_SHORT &&
		iinfo->i_alloc_type != ICBTAG_FLAG_AD_LONG &&
		iinfo->i_alloc_type != ICBTAG_FLAG_AD_IN_ICB) {
		ret = -EIO;
		goto out;
		}
		iinfo->i_unique = 0;
		iinfo->i_lenEAttr = 0;
		iinfo->i_lenExtents = 0;