linux-kernel - [PATCH] [151/275] ldm: corrupted partition table can cause kernel oops

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <20110330210632.AC9D93E1A05@tassilo.jf.intel.com>
Date:	Wed, 30 Mar 2011 14:06:32 -0700 (PDT)
From:	Andi Kleen <andi@...stfloor.org>
To:	Warns@...-sense.de, warns@...-sense.de, ak@...ux.intel.com,
	eugeneteo@...nel.sg, ldm@...tcap.org, harvey.harrison@...il.com,
	akpm@...ux-foundation.org, torvalds@...ux-foundation.org,
	gregkh@...e.de, linux-kernel@...r.kernel.org, stable@...nel.org,
	tim.bird@...sony.com
Subject: [PATCH] [151/275] ldm: corrupted partition table can cause kernel oops

2.6.35-longterm review patch.  If anyone has any objections, please let me know.

------------------
From: Timo Warns <Warns@...-sense.de>

commit 294f6cf48666825d23c9372ef37631232746e40d upstream.

The kernel automatically evaluates partition tables of storage devices.
The code for evaluating LDM partitions (in fs/partitions/ldm.c) contains
a bug that causes a kernel oops on certain corrupted LDM partitions.  A
kernel subsystem seems to crash, because, after the oops, the kernel no
longer recognizes newly connected storage devices.

The patch changes ldm_parse_vmdb() to Validate the value of vblk_size.

Signed-off-by: Timo Warns <warns@...-sense.de>
Signed-off-by: Andi Kleen <ak@...ux.intel.com>
Cc: Eugene Teo <eugeneteo@...nel.sg>
Acked-by: Richard Russon <ldm@...tcap.org>
Cc: Harvey Harrison <harvey.harrison@...il.com>
Signed-off-by: Andrew Morton <akpm@...ux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@...ux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@...e.de>

---
 fs/partitions/ldm.c |    5 +++++
 1 file changed, 5 insertions(+)

Index: linux-2.6.35.y/fs/partitions/ldm.c
===================================================================
--- linux-2.6.35.y.orig/fs/partitions/ldm.c	2011-03-29 22:51:05.872572904 -0700
+++ linux-2.6.35.y/fs/partitions/ldm.c	2011-03-29 23:03:01.398264393 -0700
@@ -251,6 +251,11 @@
 	}
 
 	vm->vblk_size     = get_unaligned_be32(data + 0x08);
+	if (vm->vblk_size == 0) {
+		ldm_error ("Illegal VBLK size");
+		return false;
+	}
+
 	vm->vblk_offset   = get_unaligned_be32(data + 0x0C);
 	vm->last_vblk_seq = get_unaligned_be32(data + 0x04);
 
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/