linux-kernel - Re: [PATCH] udf: fix dvd mounting error

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Fri, 16 Nov 2018 13:56:33 +0100
From:   Jan Kara <jack@...e.cz>
To:     Sudip Mukherjee <sudipm.mukherjee@...il.com>
Cc:     Jan Kara <jack@...e.com>, linux-kernel@...r.kernel.org,
        Andrew Gabbasov <andrew_gabbasov@...tor.com>
Subject: Re: [PATCH] udf: fix dvd mounting error

On Thu 15-11-18 12:26:00, Sudip Mukherjee wrote:
> Some DVDs are failing to mount with the error:
> 
> [  632.305370] UDF-fs: warning (device loop0): udf_load_vrs: No anchor found
> [  632.305372] UDF-fs: Scanning with blocksize 512 failed
> [  632.307837] UDF-fs: warning (device loop0): udf_load_vrs: No anchor found
> [  632.307839] UDF-fs: Scanning with blocksize 1024 failed
> [  632.309320] UDF-fs: incorrect dstring lengths (32/32)
> [  632.309361] UDF-fs: Scanning with blocksize 2048 failed
> [  632.309530] UDF-fs: warning (device loop0): udf_load_vrs: No VRS found
> [  632.309531] UDF-fs: Scanning with blocksize 4096 failed
> 
> This particular DVD used to work with v4.4 kernels, and has stopped
> working after updating the kernel to v4.14. Did a git bisect and that
> pointed to:
> c26f6c615788 ("udf: Fix conversion of 'dstring' fields to UTF8")
> 
> This patch effectively reverts c26f6c615788 and removes the length
> check that it introduced. And after this patch:
> 
> [   61.767204] UDF-fs: warning (device loop0): udf_load_vrs: No anchor found
> [   61.767206] UDF-fs: Scanning with blocksize 512 failed
> [   61.770011] UDF-fs: warning (device loop0): udf_load_vrs: No anchor found
> [   61.770026] UDF-fs: Scanning with blocksize 1024 failed
> [   61.773006] UDF-fs: warning (device loop0): udf_load_vrs: No anchor found
> [   61.773007] UDF-fs: Scanning with blocksize 512 failed
> [   61.774401] UDF-fs: warning (device loop0): udf_load_vrs: No anchor found
> [   61.774402] UDF-fs: Scanning with blocksize 1024 failed
> [   61.775045] UDF-fs: INFO Mounting volume 'TOUR_2017_THANKSGIVING_25_DISC ',
> 			timestamp 2018/01/30 05:57 (1000)
> 
> The DVD is available at:
> https://www.amazon.co.jp/Live-%E3%80%8CMr-Children-DOME-STADIUM-Thanksgiving/dp/B079B5W6KC
> 
> Cc: Andrew Gabbasov <andrew_gabbasov@...tor.com>
> Signed-off-by: Sudip Mukherjee <sudipm.mukherjee@...il.com>

Thanks for report and the analysis! Looking at the UDF specification and
your report, the media is simply incorrect. However I do agree that it is
lame to just refuse to mount the media when we don't need the problematic
string for anything important. However I don't agree with just stopping the
checking of string length. That opens potential security issues with
corrupted media. Attached patch should fix your problem in a safe way. Can
you please test it with your media?

								Honza

> ---
> 
> I dont't think this is the correct fix but has solved the problem for
> now. I have the iso image of the DVD for testing, and if there is a better
> solution I can test.
> 
>  fs/udf/unicode.c | 8 +-------
>  1 file changed, 1 insertion(+), 7 deletions(-)
> 
> diff --git a/fs/udf/unicode.c b/fs/udf/unicode.c
> index 45234791fec2..9f80c56178a5 100644
> --- a/fs/udf/unicode.c
> +++ b/fs/udf/unicode.c
> @@ -356,14 +356,8 @@ int udf_dstrCS0toChar(struct super_block *sb, uint8_t *utf_o, int o_len,
>  {
>  	int s_len = 0;
>  
> -	if (i_len > 0) {
> +	if (i_len > 0)
>  		s_len = ocu_i[i_len - 1];
> -		if (s_len >= i_len) {
> -			pr_err("incorrect dstring lengths (%d/%d)\n",
> -			       s_len, i_len);
> -			return -EINVAL;
> -		}
> -	}
>  
>  	return udf_name_from_CS0(sb, utf_o, o_len, ocu_i, s_len, 0);
>  }
> -- 
> 2.11.0
> 
> 
-- 
Jan Kara <jack@...e.com>
SUSE Labs, CR

View attachment "0001-udf-Allow-mounting-volumes-with-incorrect-identifica.patch" of type "text/x-patch" (3201 bytes)