From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 4403E3D9693; Tue, 12 May 2026 17:45:57 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1778607957; cv=none; b=HWDFAQhg0RNEe3N2LbdCsPXQW6jQkVxwe+wVnOwF41MubeiIXsZSnIAqrVLwwgcuXB84885oWbo/GVZdknEYZAICyUqJSsqqoSZkKvmv9Z9P6eQ26Z992guJszqKAwjNocmnIx+plsTEY9+1R0vYODviqAwv+kEEd7BF4EZHxgI= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1778607957; c=relaxed/simple; bh=kZnrlTl5U2zDjPl+Dao4Yb13ghNl3NfxmMuyFyb5hek=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=YIxLl6nDy2/pOxFaiNetnBhEIQvFbfhwBTfx03AmMqlvQHBfC3xnpB5Yq7tQNeDAM6sNwtn6nVPHRMG562TTCUwsMvygMfV9R/A+Kboz9HGCN6pf8/A6hWVsC7/2SiJ337RNQd7yaMw91Ng76jb8BpuBzKuH9+k5X9E4mUfgDBM= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=mChtL9QA; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="mChtL9QA" Received: by smtp.kernel.org (Postfix) with ESMTPSA id CF5D9C2BCB0; Tue, 12 May 2026 17:45:56 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1778607957; bh=kZnrlTl5U2zDjPl+Dao4Yb13ghNl3NfxmMuyFyb5hek=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=mChtL9QA0CaiM9IwzREpEi5iVbI50n9ANRpPoipQE0uGC9XIw3tcGkcqQ6B3YqG4i kw7+RPW3PK+Ud6CHiEDREMvDCzs7oPHur3/1O7Gsi/6AKpFbC3oYSg2tarX62izad1 hVQXpsCCfRt/A0YwuUOf79qo12RtgpTEbOahfXFg= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Michael Bommarito , Jan Kara Subject: [PATCH 6.12 099/206] udf: reject descriptors with oversized CRC length Date: Tue, 12 May 2026 19:39:11 +0200 Message-ID: <20260512173934.955487124@linuxfoundation.org> X-Mailer: git-send-email 2.54.0 In-Reply-To: <20260512173932.810559588@linuxfoundation.org> References: <20260512173932.810559588@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: patches@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 6.12-stable review patch. If anyone has any objections, please let me know. ------------------ From: Michael Bommarito commit 55d41b0a20128e86b9e960dd2e3f0a2d69a18df7 upstream. udf_read_tagged() skips CRC verification when descCRCLength + sizeof(struct tag) exceeds the block size. A crafted UDF image can set descCRCLength to an oversized value to bypass CRC validation entirely; the descriptor is then accepted based solely on the 8-bit tag checksum, which is trivially recomputable. Reject such descriptors instead of silently accepting them. A legitimate single-block descriptor should never have a CRC length that exceeds the block. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Cc: stable@vger.kernel.org Assisted-by: Claude:claude-opus-4-6 Assisted-by: Codex:gpt-5-4 Signed-off-by: Michael Bommarito Link: https://patch.msgid.link/20260413211240.853662-1-michael.bommarito@gmail.com Signed-off-by: Jan Kara Signed-off-by: Greg Kroah-Hartman --- fs/udf/misc.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) --- a/fs/udf/misc.c +++ b/fs/udf/misc.c @@ -230,8 +230,12 @@ struct buffer_head *udf_read_tagged(stru } /* Verify the descriptor CRC */ - if (le16_to_cpu(tag_p->descCRCLength) + sizeof(struct tag) > sb->s_blocksize || - le16_to_cpu(tag_p->descCRC) == crc_itu_t(0, + if (le16_to_cpu(tag_p->descCRCLength) + sizeof(struct tag) > sb->s_blocksize) { + udf_err(sb, "block %u: CRC length %u exceeds block size\n", + block, le16_to_cpu(tag_p->descCRCLength)); + goto error_out; + } + if (le16_to_cpu(tag_p->descCRC) == crc_itu_t(0, bh->b_data + sizeof(struct tag), le16_to_cpu(tag_p->descCRCLength))) return bh;