]> git.ipfire.org Git - thirdparty/kernel/stable.git/commit
udf: prevent integer overflow in udf_bitmap_free_blocks()
authorRoman Smirnov <r.smirnov@omp.ru>
Thu, 20 Jun 2024 07:24:13 +0000 (10:24 +0300)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Wed, 14 Aug 2024 13:34:10 +0000 (15:34 +0200)
commit05fb2bf477d3fe5421bd4cb699574737f52bd88b
tree7895293aafe1a69e061cd02ef8fe984204c20593
parenta5594c1e03b0df3908b1e1202a1ba34422eed0f6
udf: prevent integer overflow in udf_bitmap_free_blocks()

[ Upstream commit 56e69e59751d20993f243fb7dd6991c4e522424c ]

An overflow may occur if the function is called with the last
block and an offset greater than zero. It is necessary to add
a check to avoid this.

Found by Linux Verification Center (linuxtesting.org) with Svace.

[JK: Make test cover also unalloc table freeing]

Link: https://patch.msgid.link/20240620072413.7448-1-r.smirnov@omp.ru
Suggested-by: Jan Kara <jack@suse.com>
Signed-off-by: Roman Smirnov <r.smirnov@omp.ru>
Signed-off-by: Jan Kara <jack@suse.cz>
Signed-off-by: Sasha Levin <sashal@kernel.org>
fs/udf/balloc.c