[PATCH] [151/275] ldm: corrupted partition table can cause kernel oops

From: Andi Kleen
Date: Wed Mar 30 2011 - 17:38:42 EST


2.6.35-longterm review patch. If anyone has any objections, please let me know.

------------------
From: Timo Warns <Warns@xxxxxxxxxxxx>

commit 294f6cf48666825d23c9372ef37631232746e40d upstream.

The kernel automatically evaluates partition tables of storage devices.
The code for evaluating LDM partitions (in fs/partitions/ldm.c) contains
a bug that causes a kernel oops on certain corrupted LDM partitions. A
kernel subsystem seems to crash, because, after the oops, the kernel no
longer recognizes newly connected storage devices.

The patch changes ldm_parse_vmdb() to Validate the value of vblk_size.

Signed-off-by: Timo Warns <warns@xxxxxxxxxxxx>
Signed-off-by: Andi Kleen <ak@xxxxxxxxxxxxxxx>
Cc: Eugene Teo <eugeneteo@xxxxxxxxx>
Acked-by: Richard Russon <ldm@xxxxxxxxxxx>
Cc: Harvey Harrison <harvey.harrison@xxxxxxxxx>
Signed-off-by: Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx>
Signed-off-by: Linus Torvalds <torvalds@xxxxxxxxxxxxxxxxxxxx>
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxx>

---
fs/partitions/ldm.c | 5 +++++
1 file changed, 5 insertions(+)

Index: linux-2.6.35.y/fs/partitions/ldm.c
===================================================================
--- linux-2.6.35.y.orig/fs/partitions/ldm.c 2011-03-29 22:51:05.872572904 -0700
+++ linux-2.6.35.y/fs/partitions/ldm.c 2011-03-29 23:03:01.398264393 -0700
@@ -251,6 +251,11 @@
}

vm->vblk_size = get_unaligned_be32(data + 0x08);
+ if (vm->vblk_size == 0) {
+ ldm_error ("Illegal VBLK size");
+ return false;
+ }
+
vm->vblk_offset = get_unaligned_be32(data + 0x0C);
vm->last_vblk_seq = get_unaligned_be32(data + 0x04);

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/