diff options
| author | Peter Jones <pjones@redhat.com> | 2013-02-27 17:05:17 -0800 |
|---|---|---|
| committer | Linus Torvalds <torvalds@linux-foundation.org> | 2013-02-27 19:10:21 -0800 |
| commit | 8b8a6e1881be8d73b7a98f84ccec61e624ec5cac (patch) | |
| tree | 4e5e883aeee2ee9371b97e52a053d07c24939f2d /block/partitions | |
| parent | 86ee8ba64daf5e09a71e4c216f81fae8d1c937f3 (diff) | |
| download | lwn-8b8a6e1881be8d73b7a98f84ccec61e624ec5cac.tar.gz lwn-8b8a6e1881be8d73b7a98f84ccec61e624ec5cac.zip | |
block/partitions/efi.c: ensure that the GPT header is at least the size of the structure.
UEFI 2.3.1D will include a change to the spec language mandating that a
GPT header must be greater than *or equal to* the size of the defined
structure. While verifying that this would work on Linux, I discovered
that we're not actually checking the minimum bound at all.
The result of this is that when we verify the checksum, it's possible that
on a malformed header (with header_size of 0), we won't actually verify
any data.
[akpm@linux-foundation.org: fix printk warning]
Signed-off-by: Peter Jones <pjones@redhat.com>
Acked-by: Matt Fleming <matt.fleming@intel.com>
Cc: Jens Axboe <axboe@kernel.dk>
Cc: Stephen Warren <swarren@nvidia.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Diffstat (limited to 'block/partitions')
| -rw-r--r-- | block/partitions/efi.c | 12 |
1 files changed, 10 insertions, 2 deletions
diff --git a/block/partitions/efi.c b/block/partitions/efi.c index b62fb88b8711..ff5804e2f1d2 100644 --- a/block/partitions/efi.c +++ b/block/partitions/efi.c @@ -310,15 +310,23 @@ static int is_gpt_valid(struct parsed_partitions *state, u64 lba, goto fail; } - /* Check the GUID Partition Table header size */ + /* Check the GUID Partition Table header size is too big */ if (le32_to_cpu((*gpt)->header_size) > bdev_logical_block_size(state->bdev)) { - pr_debug("GUID Partition Table Header size is wrong: %u > %u\n", + pr_debug("GUID Partition Table Header size is too large: %u > %u\n", le32_to_cpu((*gpt)->header_size), bdev_logical_block_size(state->bdev)); goto fail; } + /* Check the GUID Partition Table header size is too small */ + if (le32_to_cpu((*gpt)->header_size) < sizeof(gpt_header)) { + pr_debug("GUID Partition Table Header size is too small: %u < %zu\n", + le32_to_cpu((*gpt)->header_size), + sizeof(gpt_header)); + goto fail; + } + /* Check the GUID Partition Table CRC */ origcrc = le32_to_cpu((*gpt)->header_crc32); (*gpt)->header_crc32 = 0; |