From: Wenchao Hao <haowenchao2@huawei.com>
To: Jan Kara <jack@suse.com>, <linux-kernel@vger.kernel.org>
Cc: <linfeilong@huawei.com>, Wenchao Hao <haowenchao2@huawei.com>
Subject: [PATCH 1/2] udf: add helper function udf_check_tagged_bh to check tagged page
Date: Tue, 13 Jun 2023 11:22:53 +0800 [thread overview]
Message-ID: <20230613032254.1235752-2-haowenchao2@huawei.com> (raw)
In-Reply-To: <20230613032254.1235752-1-haowenchao2@huawei.com>
This helper function is used to check if a buffer head's data is valid
and would be called in future.
Signed-off-by: Wenchao Hao <haowenchao2@huawei.com>
---
fs/udf/misc.c | 60 ++++++++++++++++++++++++++++--------------------
fs/udf/udfdecl.h | 1 +
2 files changed, 36 insertions(+), 25 deletions(-)
diff --git a/fs/udf/misc.c b/fs/udf/misc.c
index 3777468d06ce..b20b53fc8d41 100644
--- a/fs/udf/misc.c
+++ b/fs/udf/misc.c
@@ -179,6 +179,40 @@ struct genericFormat *udf_get_extendedattr(struct inode *inode, uint32_t type,
return NULL;
}
+bool udf_check_tagged_bh(struct super_block *sb, struct buffer_head *bh)
+{
+ u8 checksum;
+ struct tag *tag_p = (struct tag *)(bh->b_data);
+
+ /* Verify the tag checksum */
+ checksum = udf_tag_checksum(tag_p);
+ if (checksum != tag_p->tagChecksum) {
+ udf_err(sb, "tag checksum failed, block %llu: 0x%02x != 0x%02x\n",
+ bh->b_blocknr, checksum, tag_p->tagChecksum);
+ return false;
+ }
+
+ /* Verify the tag version */
+ if (tag_p->descVersion != cpu_to_le16(0x0002U) &&
+ tag_p->descVersion != cpu_to_le16(0x0003U)) {
+ udf_err(sb, "tag version 0x%04x != 0x0002 || 0x0003, block %llu\n",
+ le16_to_cpu(tag_p->descVersion), bh->b_blocknr);
+ return false;
+ }
+
+ /* Verify the descriptor CRC */
+ if (le16_to_cpu(tag_p->descCRCLength) + sizeof(struct tag) > sb->s_blocksize ||
+ le16_to_cpu(tag_p->descCRC) == crc_itu_t(0,
+ bh->b_data + sizeof(struct tag),
+ le16_to_cpu(tag_p->descCRCLength)))
+ return true;
+
+ udf_debug("Crc failure block %llu: crc = %u, crclen = %u\n", bh->b_blocknr,
+ le16_to_cpu(tag_p->descCRC),
+ le16_to_cpu(tag_p->descCRCLength));
+ return false;
+}
+
/*
* udf_read_tagged
*
@@ -194,7 +228,6 @@ struct buffer_head *udf_read_tagged(struct super_block *sb, uint32_t block,
{
struct tag *tag_p;
struct buffer_head *bh = NULL;
- u8 checksum;
/* Read the block */
if (block == 0xFFFFFFFF)
@@ -217,32 +250,9 @@ struct buffer_head *udf_read_tagged(struct super_block *sb, uint32_t block,
goto error_out;
}
- /* Verify the tag checksum */
- checksum = udf_tag_checksum(tag_p);
- if (checksum != tag_p->tagChecksum) {
- udf_err(sb, "tag checksum failed, block %u: 0x%02x != 0x%02x\n",
- block, checksum, tag_p->tagChecksum);
- goto error_out;
- }
-
- /* Verify the tag version */
- if (tag_p->descVersion != cpu_to_le16(0x0002U) &&
- tag_p->descVersion != cpu_to_le16(0x0003U)) {
- udf_err(sb, "tag version 0x%04x != 0x0002 || 0x0003, block %u\n",
- le16_to_cpu(tag_p->descVersion), block);
- goto error_out;
- }
-
- /* Verify the descriptor CRC */
- if (le16_to_cpu(tag_p->descCRCLength) + sizeof(struct tag) > sb->s_blocksize ||
- le16_to_cpu(tag_p->descCRC) == crc_itu_t(0,
- bh->b_data + sizeof(struct tag),
- le16_to_cpu(tag_p->descCRCLength)))
+ if (udf_check_tagged_bh(sb, bh))
return bh;
- udf_debug("Crc failure block %u: crc = %u, crclen = %u\n", block,
- le16_to_cpu(tag_p->descCRC),
- le16_to_cpu(tag_p->descCRCLength));
error_out:
brelse(bh);
return NULL;
diff --git a/fs/udf/udfdecl.h b/fs/udf/udfdecl.h
index 88692512a466..fb269752b9c6 100644
--- a/fs/udf/udfdecl.h
+++ b/fs/udf/udfdecl.h
@@ -180,6 +180,7 @@ extern struct genericFormat *udf_add_extendedattr(struct inode *, uint32_t,
uint32_t, uint8_t);
extern struct genericFormat *udf_get_extendedattr(struct inode *, uint32_t,
uint8_t);
+extern bool udf_check_tagged_bh(struct super_block *sb, struct buffer_head *bh);
extern struct buffer_head *udf_read_tagged(struct super_block *, uint32_t,
uint32_t, uint16_t *);
extern struct buffer_head *udf_read_ptagged(struct super_block *,
--
2.35.3
next prev parent reply other threads:[~2023-06-12 14:01 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-06-13 3:22 [PATCH 0/2] Fix out-of-bound access if pagecache of udf device is corrupted Wenchao Hao
2023-06-12 14:40 ` Jan Kara
2023-06-13 1:43 ` haowenchao (C)
2023-06-13 3:22 ` Wenchao Hao [this message]
2023-06-13 3:22 ` [PATCH 2/2] udf:check if buffer head's data when getting lvidiu Wenchao Hao
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20230613032254.1235752-2-haowenchao2@huawei.com \
--to=haowenchao2@huawei.com \
--cc=jack@suse.com \
--cc=linfeilong@huawei.com \
--cc=linux-kernel@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox