From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=100.103.45.18 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1794062766; b=oaPtx4PM6zC/zQcGnIVw3o5RQfW/Xw4zKKP2NOGC8LhTyFbHj8mRjEMQoJ2iwF6Zru/u HIK0Rw8SCXSZz5QOx012tMoqfZFIhB5XDA1cPP2rYOAk6SR1vXILdZo0UzdH9xMNwwIKB yYofhF44z4NKMOH0yymVer/H+JeaubXcPCF3ZHs1Jj3cSPfmcip/qYx6dvGxPagOtUugI jLMbpq4LNeCXKysPQNKRr0fQNLjoDZ5k/zM6rReO8ynIe/QmRIf5AnrmO+f1X7j7RiF4f a0tcMkk86NJLUlJPIGir8thL/AYTxqtUKgvvfmDZDT/06VOZyvuACdxdDdcKxq2JsHQ== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1794062766; h=Received:DKIM-Signature:From:To:Cc:Subject:Date:Message-ID:X-Mailer: In-Reply-To:References:User-Agent:X-stable:X-Patchwork-Hint: MIME-Version:Content-Transfer-Encoding; bh=VCAdxGBhyWI0LN4x5ZMEEAIxD+P/let8CrbLcu5Fwes=; b=BOv70kna5K/c2kF4OlKhobzcw8eDBT5DjeBL9PyPTribO2nZ2oLHSo1fZ+kwwleGH97h VHYuHaUVofaGBhjeE0FSuSChCd40+awZ0+TfzZIiYsZ67BsM4zn+d4WEd5DnKDKjLPygx 0SqkS5zj0lRmYE2HjibMvX6no7y4pzzzx7lTAg/4MHA/oiNmToUgqfWyX6WoCktIhfehy lofDUDmXr7vtZfHVDtKSchwwwmfCSq6scPIbKeVj5wAiA6rfsPYbJTwFzxRHQTGA2sk3l K6PtYc4nIPxkO6V94DqkDKmilzh7Pz2PauwwOPLcPCWZ9Oy8MxYqB7ZeT135jLg5Gxg== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass header.d=linuxfoundation.org header.i=@linuxfoundation.org header.a=rsa-sha256 header.s=korg header.b=Lp5PlS8s; arc=none smtp.remote-ip=100.103.45.18 Received: from smtp.kernel.org (quasi.space.kernel.org [100.103.45.18]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (prime256v1)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 3E335606A326; Sat, 7 Nov 2026 14:46:06 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.a=rsa-sha256 header.s=korg header.b=Lp5PlS8s Received: by smtp.kernel.org (Postfix) with ESMTPSA id DDF821F0089F; Sat, 7 Nov 2026 14:46:05 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1794062766; bh=VCAdxGBhyWI0LN4x5ZMEEAIxD+P/let8CrbLcu5Fwes=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=Lp5PlS8sPHUEgPDlYcJkpMet21N1uhhQusfR1YGQcpQ869fkVhxmNc9DWWPBKzP+e zMd57eqgsqZNTtqKOFBlPSpITuW91jQhai0Y0N20msFvh8XULDxKnEKdLgoekHiwO6 ukifzat4P+LedAoOnFzZCMJzCb3Oh4mSyzPygmXY= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Baolin Liu , Jan Kara , Sasha Levin Subject: [PATCH 6.18 075/869] isofs: fix Rock Ridge CE extent validation on multisession media Date: Sat, 7 Nov 2026 08:45:57 -0500 Message-ID: <20261107134855.297606948@linuxfoundation.org> X-Mailer: git-send-email 2.56.0 In-Reply-To: <20261107134852.069646174@linuxfoundation.org> References: <20261107134852.069646174@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore X-Mailing-List: stable@vger.kernel.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 6.18-stable review patch. If anyone has any objections, please let me know. ------------------ From: Baolin Liu [ Upstream commit 43de050fa4a31f7e7a73cf8974dcf6037e161a39 ] Commit a36d990f5913 ("isofs: validate Rock Ridge CE continuation extent against volume size") compares the CE extent directly with s_nzones. The extent is an absolute block number, while s_nzones is the number of blocks relative to the selected ISO session. The comparison is therefore wrong when a multisession disc starts at a non-zero block. isofs_get_last_session() selects the last session on multisession media, and its volume descriptors describe a volume beginning at that session's LBA. For example, a session beginning at LBA 45447 with 64 blocks can contain a valid CE at absolute LBA 45467. The existing check rejects that CE, so the ER continuation record is not read, Rock Ridge is disabled, and the mount falls back to Joliet names. Save the selected session start in filesystem-block units and validate the CE extent against the half-open interval [session_start, session_end). Scale the session length to the same block units and retain a separate block-device limit. The lower bound is intentional: accepting arbitrary blocks before the selected session could make a CE read data from a previous session or another filesystem on the device. Only apply the bounds check when cont_extent is non-zero. A zero extent is the in-memory sentinel indicating that no CE continuation was found, rather than a request to read block zero. For a single-session image, session_start is zero and the effective volume boundary remains unchanged. Build-tested with: make CONFIG_RUST= CONFIG_RUST_DRIVERS= fs/isofs/ Fixes: a36d990f5913 ("isofs: validate Rock Ridge CE continuation extent against volume size") Cc: stable@vger.kernel.org Signed-off-by: Baolin Liu Link: https://patch.msgid.link/20260907082602.3777551-1-liubaolin12138@163.com Signed-off-by: Jan Kara Signed-off-by: Sasha Levin --- fs/isofs/inode.c | 2 ++ fs/isofs/isofs.h | 2 ++ fs/isofs/rock.c | 11 +++++++++-- 3 files changed, 13 insertions(+), 2 deletions(-) diff --git a/fs/isofs/inode.c b/fs/isofs/inode.c index 3433fa14cd014..8a0da54f391d0 100644 --- a/fs/isofs/inode.c +++ b/fs/isofs/inode.c @@ -821,6 +821,8 @@ static int isofs_fill_super(struct super_block *s, struct fs_context *fc) if (!sb_set_blocksize(s, orig_zonesize)) goto out_freesbi; + sbi->s_session_start = (sector_t)vol_desc_start << + (ISOFS_BLOCK_BITS - s->s_blocksize_bits); sbi->s_nls_iocharset = NULL; #ifdef CONFIG_JOLIET diff --git a/fs/isofs/isofs.h b/fs/isofs/isofs.h index 5065558375333..a36a634797435 100644 --- a/fs/isofs/isofs.h +++ b/fs/isofs/isofs.h @@ -35,6 +35,8 @@ struct isofs_sb_info { unsigned long s_firstdatazone; unsigned long s_log_zone_size; unsigned long s_max_size; + /* Session start in filesystem block units. */ + sector_t s_session_start; int s_rock_offset; /* offset of SUSP fields within SU area */ s32 s_sbsector; diff --git a/fs/isofs/rock.c b/fs/isofs/rock.c index 869b331eff4f6..a4a337301b6f9 100644 --- a/fs/isofs/rock.c +++ b/fs/isofs/rock.c @@ -9,6 +9,7 @@ #include #include +#include #include "isofs.h" #include "rock.h" @@ -84,6 +85,10 @@ static void init_rock_state(struct rock_state *rs, struct inode *inode) */ static int rock_continue(struct rock_state *rs) { + struct super_block *sb = rs->inode->i_sb; + struct isofs_sb_info *sbi = ISOFS_SB(sb); + sector_t session_end = sbi->s_session_start + + ((sector_t)sbi->s_nzones << (ISOFS_BLOCK_BITS - sb->s_blocksize_bits)); int ret = 1; int blocksize = 1 << rs->inode->i_blkbits; const int min_de_size = offsetof(struct rock_ridge, u); @@ -101,11 +106,13 @@ static int rock_continue(struct rock_state *rs) goto out; } - if ((unsigned)rs->cont_extent >= ISOFS_SB(rs->inode->i_sb)->s_nzones) { + if (rs->cont_extent && + (rs->cont_extent < sbi->s_session_start || + rs->cont_extent >= session_end)) { printk(KERN_NOTICE "rock: corrupted directory entry. " "extent=%u out of volume (nzones=%lu)\n", (unsigned)rs->cont_extent, - ISOFS_SB(rs->inode->i_sb)->s_nzones); + sbi->s_nzones); ret = -EIO; goto out; } -- 2.53.0