[PATCH 0/2] Fix out-of-bound access if pagecache of udf device is corrupted

[Wenchao Hao]

Following steps would cause out-of-bound access and even cause kernel
panic when using udf:

dd if=/dev/zero of=udf.img bs=1M count=512
mkfs.udf udf.img
mount -o loop -t udf udf.img /mnt
dd if=/dev/random of=/dev/loop0 bs=512 count=1 seek=128
umount /mnt

[if /mnt is mounted on /dev/loop0]

It is because we did not check if udf_sb_info->s_lvid_bh is valid in
udf_sb_lvidiu().

Although it's illegal to write backend device since filesystem has been
mounted, but we should avoid kernel panic if it happened.

The first patch add a helper function to check if the data is valid.
The second patch just call the helper function, if check failed, return
NULL from udf_sb_lvidiu()

Wenchao Hao (2):
  udf: add helper function udf_check_tagged_bh to check tagged page
  udf:check if buffer head's data when getting lvidiu

 fs/udf/misc.c    | 60 ++++++++++++++++++++++++++++--------------------
 fs/udf/super.c   |  2 ++
 fs/udf/udfdecl.h |  1 +
 3 files changed, 38 insertions(+), 25 deletions(-)

-- 
2.35.3