← Back to branch summary

~ubuntu-branches/ubuntu/lucid/linux-lts-backport-natty/lucid-proposed

« back to all changes in this revision

Viewing changes to fs/udf/super.c

  • Committer: Package Import Robot
  • Author(s): Luis Henriques, Luis Henriques, Upstream Kernel Changes
  • Date: 2012-08-15 09:46:38 UTC
  • Revision ID: package-import@ubuntu.com-20120815094638-n6urjpliowtih76d
Tags: 2.6.38-15.66~lucid1
https://launchpad.net/bugs/1036914
https://launchpad.net/bugs/1024497
https://launchpad.net/bugs/1024497
https://launchpad.net/bugs/1009207
[Luis Henriques]

* Release Tracking Bug
  - LP: #1036914

[ Upstream Kernel Changes ]

* udf: Fortify loading of sparing table
  - LP: #1024497
  - CVE-2012-3400
* udf: Avoid run away loop when partition table length is corrupted
  - LP: #1024497
  - CVE-2012-3400
* eCryptfs: Gracefully refuse miscdev file ops on inherited/passed files
* eCryptfs: Copy up POSIX ACL and read-only flags from lower mount
  - LP: #1009207

Show diffs side-by-side

added added

removed removed

Lines of Context:
fs/udf/super.c
56
56
#include <linux/seq_file.h>
57
57
#include <linux/bitmap.h>
58
58
#include <linux/crc-itu-t.h>
 
59
#include <linux/log2.h>
59
60
#include <asm/byteorder.h>
60
61
 
61
62
#include "udf_sb.h"
1244
1245
        return ret;
1245
1246
}
1246
1247
 
 
1248
static int udf_load_sparable_map(struct super_block *sb,
 
1249
                                 struct udf_part_map *map,
 
1250
                                 struct sparablePartitionMap *spm)
 
1251
{
 
1252
        uint32_t loc;
 
1253
        uint16_t ident;
 
1254
        struct sparingTable *st;
 
1255
        struct udf_sparing_data *sdata = &map->s_type_specific.s_sparing;
 
1256
        int i;
 
1257
        struct buffer_head *bh;
 
1258
 
 
1259
        map->s_partition_type = UDF_SPARABLE_MAP15;
 
1260
        sdata->s_packet_len = le16_to_cpu(spm->packetLength);
 
1261
        if (!is_power_of_2(sdata->s_packet_len)) {
 
1262
                udf_error(sb, __func__,
 
1263
                        "error loading logical volume descriptor: "
 
1264
                        "Invalid packet length %u\n",
 
1265
                        (unsigned)sdata->s_packet_len);
 
1266
                return -EIO;
 
1267
        }
 
1268
        if (spm->numSparingTables > 4) {
 
1269
                udf_error(sb, __func__,
 
1270
                        "error loading logical volume descriptor: "
 
1271
                        "Too many sparing tables (%d)\n",
 
1272
                        (int)spm->numSparingTables);
 
1273
                return -EIO;
 
1274
        }
 
1275
 
 
1276
        for (i = 0; i < spm->numSparingTables; i++) {
 
1277
                loc = le32_to_cpu(spm->locSparingTable[i]);
 
1278
                bh = udf_read_tagged(sb, loc, loc, &ident);
 
1279
                if (!bh)
 
1280
                        continue;
 
1281
 
 
1282
                st = (struct sparingTable *)bh->b_data;
 
1283
                if (ident != 0 ||
 
1284
                    strncmp(st->sparingIdent.ident, UDF_ID_SPARING,
 
1285
                            strlen(UDF_ID_SPARING)) ||
 
1286
                    sizeof(*st) + le16_to_cpu(st->reallocationTableLen) >
 
1287
                                                        sb->s_blocksize) {
 
1288
                        brelse(bh);
 
1289
                        continue;
 
1290
                }
 
1291
 
 
1292
                sdata->s_spar_map[i] = bh;
 
1293
        }
 
1294
        map->s_partition_func = udf_get_pblock_spar15;
 
1295
        return 0;
 
1296
}
 
1297
 
1247
1298
static int udf_load_logicalvol(struct super_block *sb, sector_t block,
1248
1299
                               struct kernel_lb_addr *fileset)
1249
1300
{
1250
1301
        struct logicalVolDesc *lvd;
1251
 
        int i, j, offset;
 
1302
        int i, offset;
1252
1303
        uint8_t type;
1253
1304
        struct udf_sb_info *sbi = UDF_SB(sb);
1254
1305
        struct genericPartitionMap *gpm;
1255
1306
        uint16_t ident;
1256
1307
        struct buffer_head *bh;
 
1308
        unsigned int table_len;
1257
1309
        int ret = 0;
1258
1310
 
1259
1311
        bh = udf_read_tagged(sb, block, block, &ident);
1261
1313
                return 1;
1262
1314
        BUG_ON(ident != TAG_IDENT_LVD);
1263
1315
        lvd = (struct logicalVolDesc *)bh->b_data;
 
1316
        table_len = le32_to_cpu(lvd->mapTableLength);
 
1317
        if (sizeof(*lvd) + table_len > sb->s_blocksize) {
 
1318
                udf_error(sb, __func__,
 
1319
                        "error loading logical volume descriptor: "
 
1320
                        "Partition table too long (%u > %lu)\n", table_len,
 
1321
                        sb->s_blocksize - sizeof(*lvd));
 
1322
                goto out_bh;
 
1323
        }
1264
1324
 
1265
1325
        i = udf_sb_alloc_partition_maps(sb, le32_to_cpu(lvd->numPartitionMaps));
1266
1326
        if (i != 0) {
1269
1329
        }
1270
1330
 
1271
1331
        for (i = 0, offset = 0;
1272
 
             i < sbi->s_partitions && offset < le32_to_cpu(lvd->mapTableLength);
 
1332
             i < sbi->s_partitions && offset < table_len;
1273
1333
             i++, offset += gpm->partitionMapLength) {
1274
1334
                struct udf_part_map *map = &sbi->s_partmaps[i];
1275
1335
                gpm = (struct genericPartitionMap *)
1304
1364
                        } else if (!strncmp(upm2->partIdent.ident,
1305
1365
                                                UDF_ID_SPARABLE,
1306
1366
                                                strlen(UDF_ID_SPARABLE))) {
1307
 
                                uint32_t loc;
1308
 
                                struct sparingTable *st;
1309
 
                                struct sparablePartitionMap *spm =
1310
 
                                        (struct sparablePartitionMap *)gpm;
1311
 
 
1312
 
                                map->s_partition_type = UDF_SPARABLE_MAP15;
1313
 
                                map->s_type_specific.s_sparing.s_packet_len =
1314
 
                                                le16_to_cpu(spm->packetLength);
1315
 
                                for (j = 0; j < spm->numSparingTables; j++) {
1316
 
                                        struct buffer_head *bh2;
1317
 
 
1318
 
                                        loc = le32_to_cpu(
1319
 
                                                spm->locSparingTable[j]);
1320
 
                                        bh2 = udf_read_tagged(sb, loc, loc,
1321
 
                                                             &ident);
1322
 
                                        map->s_type_specific.s_sparing.
1323
 
                                                        s_spar_map[j] = bh2;
1324
 
 
1325
 
                                        if (bh2 == NULL)
1326
 
                                                continue;
1327
 
 
1328
 
                                        st = (struct sparingTable *)bh2->b_data;
1329
 
                                        if (ident != 0 || strncmp(
1330
 
                                                st->sparingIdent.ident,
1331
 
                                                UDF_ID_SPARING,
1332
 
                                                strlen(UDF_ID_SPARING))) {
1333
 
                                                brelse(bh2);
1334
 
                                                map->s_type_specific.s_sparing.
1335
 
                                                        s_spar_map[j] = NULL;
1336
 
                                        }
1337
 
                                }
1338
 
                                map->s_partition_func = udf_get_pblock_spar15;
 
1367
                                if (udf_load_sparable_map(sb, map,
 
1368
                                    (struct sparablePartitionMap *)gpm) < 0)
 
1369
                                        goto out_bh;
1339
1370
                        } else if (!strncmp(upm2->partIdent.ident,
1340
1371
                                                UDF_ID_METADATA,
1341
1372
                                                strlen(UDF_ID_METADATA))) {