Re: [PATCH] udf: reject VAT indexes equal to the entry count

[Jan Kara]

On Wed 08-07-26 10:17:09, David Lee wrote:
> UDF 1.50 virtual partition mapping uses the VAT as an array of physical
> block mappings. s_num_entries stores the number of entries in that array,
> not the highest valid index. The valid VAT indexes are therefore below
> s_num_entries.
> 
> udf_get_pblock_virt15() currently rejects only indexes greater than
> s_num_entries. A crafted image can request index s_num_entries, pass the
> bounds check, and make the kernel read one entry past the allocated VAT table.
> 
> Change the check to reject block >= s_num_entries, so the count is handled as
> an exclusive upper bound.
> 
> A crafted UDF image reproduced this on origin/master commit
> 0e35b9b6ec0ffcc5e23cbdec09f5c622ad532b53 with a KASAN slab-out-of-bounds
> report in udf_get_pblock_virt15().
> 
> Trail of Bits has a reproducer that triggers kernel panic demonstrating the bug, and can share it if needed.
> 
> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: David Lee <david.lee@xxxxxxxxxxxxxxx>
> Assisted-by: Codex:gpt-5.5

Thanks! I've added the patch to my tree.

								Honza

> ---
> fs/udf/partition.c |    2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/fs/udf/partition.c b/fs/udf/partition.c
> index 2b85c95..ad8dced 100644
> --- a/fs/udf/partition.c
> +++ b/fs/udf/partition.c
> @@ -55,7 +55,7 @@ uint32_t udf_get_pblock_virt15(struct super_block *sb, uint32_t block,
>  	map = &sbi->s_partmaps[partition];
>  	vdata = &map->s_type_specific.s_virtual;
>  
> -	if (block > vdata->s_num_entries) {
> +	if (block >= vdata->s_num_entries) {
>  		udf_debug("Trying to access block beyond end of VAT (%u max %u)\n",
>  			  block, vdata->s_num_entries);
>  		return 0xFFFFFFFF;
-- 
Jan Kara <jack@xxxxxxxx>
SUSE Labs, CR