Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 3ebacb05 authored Jul 04, 2013 by Mikulas Patocka Committed by Linus Torvalds Jul 04, 2013

hpfs: better test for errors



The test if bitmap access is out of bound could errorneously pass if the
device size is divisible by 16384 sectors and we are asking for one bitmap
after the end.

Check for invalid size in the superblock. Invalid size could cause integer
overflows in the rest of the code.

Signed-off-by: Mikulas Patocka <mpatocka@artax.karlin.mff.cuni.cz>
Cc: stable@kernel.org
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

parent 8bb495e3

fs/hpfs/map.c

+2 −1

Original line number	Diff line number	Diff line
		@@ -17,7 +17,8 @@ __le32 hpfs_map_bitmap(struct super_block s, unsigned bmp_block,
		struct quad_buffer_head qbh, char id)
		{
		secno sec;
		if (hpfs_sb(s)->sb_chk) if (bmp_block * 16384 > hpfs_sb(s)->sb_fs_size) {
		unsigned n_bands = (hpfs_sb(s)->sb_fs_size + 0x3fff) >> 14;
		if (hpfs_sb(s)->sb_chk) if (bmp_block >= n_bands) {
		hpfs_error(s, "hpfs_map_bitmap called with bad parameter: %08x at %s", bmp_block, id);
		return NULL;
		}

fs/hpfs/super.c

+7 −1

Original line number	Diff line number	Diff line
		@@ -559,6 +559,12 @@ static int hpfs_fill_super(struct super_block s, void options, int silent)
		sbi->sb_c_bitmap = -1;
		sbi->sb_max_fwd_alloc = 0xffffff;

		if (sbi->sb_fs_size >= 0x80000000) {
		hpfs_error(s, "invalid size in superblock: %08x",
		(unsigned)sbi->sb_fs_size);
		goto bail4;
		}

		/* Load bitmap directory */
		if (!(sbi->sb_bmp_dir = hpfs_load_bitmap_directory(s, le32_to_cpu(superblock->bitmaps))))
		goto bail4;