From: Thomas Weißschuh <thomas@t-8ch.de>
Date: Thu, 2 Mar 2023 15:54:39 +0000 (+0000)
Subject: libblkid: nvidia_raid: validate checksum
X-Git-Tag: v2.39-rc1~18^2~1
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=8a08c34aad61cb59c977212458bf55f5a81186e8;p=thirdparty%2Futil-linux.git

libblkid: nvidia_raid: validate checksum

See #1843

Signed-off-by: Thomas Weißschuh <thomas@t-8ch.de>
---

diff --git a/libblkid/src/superblocks/nvidia_raid.c b/libblkid/src/superblocks/nvidia_raid.c
index 35c663c8d0..f59a0e100e 100644
--- a/libblkid/src/superblocks/nvidia_raid.c
+++ b/libblkid/src/superblocks/nvidia_raid.c
@@ -27,6 +27,14 @@ struct nv_metadata {
 #define NVIDIA_SUPERBLOCK_SIZE		120
 
 
+static int nvraid_verify_checksum(blkid_probe pr, const struct nv_metadata *nv)
+{
+	uint32_t csum = le32_to_cpu(nv->chksum);
+	for (size_t i = 0; i < le32_to_cpu(nv->size); i++)
+		csum += le32_to_cpu(((uint32_t *) nv)[i]);
+	return blkid_probe_verify_csum(pr, csum, le32_to_cpu(nv->chksum));
+}
+
 static int probe_nvraid(blkid_probe pr,
 		const struct blkid_idmag *mag __attribute__((__unused__)))
 {
@@ -42,7 +50,7 @@ static int probe_nvraid(blkid_probe pr,
 	nv = (struct nv_metadata *)
 		blkid_probe_get_buffer(pr,
 				off,
-				sizeof(struct nv_metadata));
+				NVIDIA_SUPERBLOCK_SIZE);
 	if (!nv)
 		return errno ? -errno : 1;
 
@@ -50,6 +58,8 @@ static int probe_nvraid(blkid_probe pr,
 		return 1;
 	if (le32_to_cpu(nv->size) * 4 != NVIDIA_SUPERBLOCK_SIZE)
 		return 1;
+	if (!nvraid_verify_checksum(pr, nv))
+		return 1;
 	if (blkid_probe_sprintf_version(pr, "%u", le16_to_cpu(nv->version)) != 0)
 		return 1;
 	if (blkid_probe_set_magic(pr, off, sizeof(nv->vendor),