]> git.ipfire.org Git - thirdparty/kernel/stable.git/commit
partitions/efi: Fix integer overflow in GPT size calculation
authorAlden Tondettar <alden.tondettar@gmail.com>
Sun, 15 Jan 2017 22:31:56 +0000 (15:31 -0700)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Sun, 8 Oct 2017 08:11:20 +0000 (10:11 +0200)
commit40e63fb87a3f9fdf13ee19eafdc52f013068c4a8
treec3c7ffd574f42ad90ec91be8cb6ebed712b11b78
parent61e43da985aa188b075e275e1297131df0573aef
partitions/efi: Fix integer overflow in GPT size calculation

[ Upstream commit c5082b70adfe8e1ea1cf4a8eff92c9f260e364d2 ]

If a GUID Partition Table claims to have more than 2**25 entries, the
calculation of the partition table size in alloc_read_gpt_entries() will
overflow a 32-bit integer and not enough space will be allocated for the
table.

Nothing seems to get written out of bounds, but later efi_partition() will
read up to 32768 bytes from a 128 byte buffer, possibly OOPSing or exposing
information to /proc/partitions and uevents.

The problem exists on both 64-bit and 32-bit platforms.

Fix the overflow and also print a meaningful debug message if the table
size is too large.

Signed-off-by: Alden Tondettar <alden.tondettar@gmail.com>
Acked-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Signed-off-by: Jens Axboe <axboe@fb.com>
Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
block/partitions/efi.c