From 1903defc2d1d0163d73f467f08b105ebb0619b40 Mon Sep 17 00:00:00 2001 From: Lennart Poettering Date: Thu, 9 Sep 2021 11:38:52 +0200 Subject: [PATCH] dissect-image: insist that if a verity partition designator is specified the partition exists Let's tighten our checks further. --- src/shared/dissect-image.c | 32 +++++++++++++++++++------------- 1 file changed, 19 insertions(+), 13 deletions(-) diff --git a/src/shared/dissect-image.c b/src/shared/dissect-image.c index 9547dad808f..a540f866896 100644 --- a/src/shared/dissect-image.c +++ b/src/shared/dissect-image.c @@ -1401,22 +1401,28 @@ int dissect_image( return -EADDRNOTAVAIL; } - if (verity && verity->root_hash) { - if (verity->designator < 0 || verity->designator == PARTITION_ROOT) { - if (!m->partitions[PARTITION_ROOT_VERITY].found || !m->partitions[PARTITION_ROOT].found) - return -EADDRNOTAVAIL; + if (verity) { + /* If a verity designator is specified, then insist that the matching partition exists */ + if (verity->designator >= 0 && !m->partitions[verity->designator].found) + return -EADDRNOTAVAIL; - /* If we found a verity setup, then the root partition is necessarily read-only. */ - m->partitions[PARTITION_ROOT].rw = false; - m->verity_ready = true; - } + if (verity->root_hash) { + if (verity->designator < 0 || verity->designator == PARTITION_ROOT) { + if (!m->partitions[PARTITION_ROOT_VERITY].found || !m->partitions[PARTITION_ROOT].found) + return -EADDRNOTAVAIL; - if (verity->designator == PARTITION_USR) { - if (!m->partitions[PARTITION_USR_VERITY].found || !m->partitions[PARTITION_USR].found) - return -EADDRNOTAVAIL; + /* If we found a verity setup, then the root partition is necessarily read-only. */ + m->partitions[PARTITION_ROOT].rw = false; + m->verity_ready = true; + } + + if (verity->designator == PARTITION_USR) { + if (!m->partitions[PARTITION_USR_VERITY].found || !m->partitions[PARTITION_USR].found) + return -EADDRNOTAVAIL; - m->partitions[PARTITION_USR].rw = false; - m->verity_ready = true; + m->partitions[PARTITION_USR].rw = false; + m->verity_ready = true; + } } } -- 2.47.3