diff options
author | Alden Tondettar <alden.tondettar@gmail.com> | 2017-01-15 15:31:56 -0700 |
---|---|---|
committer | Jens Axboe <axboe@fb.com> | 2017-01-17 09:02:31 -0700 |
commit | c5082b70adfe8e1ea1cf4a8eff92c9f260e364d2 (patch) | |
tree | 2cc8bab578b10b57837d87d9ec274aa19af7b2a3 /block/blk-merge.c | |
parent | 1e668f4e7921e8c82838cf5f95ff4a2d5c852efc (diff) | |
download | linux-c5082b70adfe8e1ea1cf4a8eff92c9f260e364d2.tar.bz2 |
partitions/efi: Fix integer overflow in GPT size calculation
If a GUID Partition Table claims to have more than 2**25 entries, the
calculation of the partition table size in alloc_read_gpt_entries() will
overflow a 32-bit integer and not enough space will be allocated for the
table.
Nothing seems to get written out of bounds, but later efi_partition() will
read up to 32768 bytes from a 128 byte buffer, possibly OOPSing or exposing
information to /proc/partitions and uevents.
The problem exists on both 64-bit and 32-bit platforms.
Fix the overflow and also print a meaningful debug message if the table
size is too large.
Signed-off-by: Alden Tondettar <alden.tondettar@gmail.com>
Acked-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Signed-off-by: Jens Axboe <axboe@fb.com>
Diffstat (limited to 'block/blk-merge.c')
0 files changed, 0 insertions, 0 deletions