From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 380D823E356; Tue, 12 May 2026 18:08:54 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1778609334; cv=none; b=MAZBGLT7Xg9c1pPWNrpbxWKM9Wtr/PtzjUQHR9B9RfD5gj4ZnjH0/YAl6kai1us7U1Mj11tMd3zkrzg2M92xRsieRrdwI/bWHeDDA6cj7OCT9e0W+5wIWYAH6FtO3B6RZiJdDKUWnVuOkcvyFAVxbM51YRxJc1pHKy3jtuFVpK0= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1778609334; c=relaxed/simple; bh=FzYCulwLy6PHZwJVVAi/lq7BnpIds/ZjPenmXdFrlTw=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=WC+x4XgC1l+KzS/mMIIut7xM0NVHyoLiSa9+pZ27CfWtnceiu57c/zWUii2vI5X4TYeX28aAqsjTjfEofBbOanRM1j5Ox2c9P2/ChfAqst00JBj9oJ72kOjn3lQzHIAn/RIMj8xIqy8km96SQt0xe9Yq+vLDrYT43wvr/vDSz/g= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=b/fWuBZT; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="b/fWuBZT" Received: by smtp.kernel.org (Postfix) with ESMTPSA id C46F8C2BCB0; Tue, 12 May 2026 18:08:53 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1778609334; bh=FzYCulwLy6PHZwJVVAi/lq7BnpIds/ZjPenmXdFrlTw=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=b/fWuBZThFf3+JSWgzwBk16YxtZPX+tIwlAaMVWdNVYtWSuZQFWzBQN/qEyudYd0Z O0yl24hnakz1o7qqJCZ6KgLNKaN6RnbcUb/9Vu4AaeIKYJrE7DYDSZ9GMxwbpRuzuW TAlQ+VObuWsomdYTP2g44MF57RN4xf7p1VysMVcs= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Michael Bommarito , Jan Kara Subject: [PATCH 7.0 153/307] udf: reject descriptors with oversized CRC length Date: Tue, 12 May 2026 19:39:08 +0200 Message-ID: <20260512173943.355362162@linuxfoundation.org> X-Mailer: git-send-email 2.54.0 In-Reply-To: <20260512173940.117428952@linuxfoundation.org> References: <20260512173940.117428952@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: patches@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 7.0-stable review patch. If anyone has any objections, please let me know. ------------------ From: Michael Bommarito commit 55d41b0a20128e86b9e960dd2e3f0a2d69a18df7 upstream. udf_read_tagged() skips CRC verification when descCRCLength + sizeof(struct tag) exceeds the block size. A crafted UDF image can set descCRCLength to an oversized value to bypass CRC validation entirely; the descriptor is then accepted based solely on the 8-bit tag checksum, which is trivially recomputable. Reject such descriptors instead of silently accepting them. A legitimate single-block descriptor should never have a CRC length that exceeds the block. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Cc: stable@vger.kernel.org Assisted-by: Claude:claude-opus-4-6 Assisted-by: Codex:gpt-5-4 Signed-off-by: Michael Bommarito Link: https://patch.msgid.link/20260413211240.853662-1-michael.bommarito@gmail.com Signed-off-by: Jan Kara Signed-off-by: Greg Kroah-Hartman --- fs/udf/misc.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) --- a/fs/udf/misc.c +++ b/fs/udf/misc.c @@ -230,8 +230,12 @@ struct buffer_head *udf_read_tagged(stru } /* Verify the descriptor CRC */ - if (le16_to_cpu(tag_p->descCRCLength) + sizeof(struct tag) > sb->s_blocksize || - le16_to_cpu(tag_p->descCRC) == crc_itu_t(0, + if (le16_to_cpu(tag_p->descCRCLength) + sizeof(struct tag) > sb->s_blocksize) { + udf_err(sb, "block %u: CRC length %u exceeds block size\n", + block, le16_to_cpu(tag_p->descCRCLength)); + goto error_out; + } + if (le16_to_cpu(tag_p->descCRC) == crc_itu_t(0, bh->b_data + sizeof(struct tag), le16_to_cpu(tag_p->descCRCLength))) return bh;