From: Jan Kara <jack@suse.cz>
Date: Wed, 12 Dec 2018 13:29:20 +0000 (+0100)
Subject: udf: Fix BUG on corrupted inode
X-Git-Tag: v4.20.8~192
X-Git-Url: https://www.infradead.org/git/?a=commitdiff_plain;h=570f31838a932c1c748db703a49e0671ee84ce08;p=users%2Fdwmw2%2Flinux.git

udf: Fix BUG on corrupted inode

[ Upstream commit d288d95842f1503414b7eebce3773bac3390457e ]

When inode is corrupted so that extent type is invalid, some functions
(such as udf_truncate_extents()) will just BUG. Check that extent type
is valid when loading the inode to memory.

Reported-by: Anatoly Trosinenko <anatoly.trosinenko@gmail.com>
Signed-off-by: Jan Kara <jack@suse.cz>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---

diff --git a/fs/udf/inode.c b/fs/udf/inode.c
index 5df554a9f9c95..ae796e10f68b2 100644
--- a/fs/udf/inode.c
+++ b/fs/udf/inode.c
@@ -1357,6 +1357,12 @@ reread:
 
 	iinfo->i_alloc_type = le16_to_cpu(fe->icbTag.flags) &
 							ICBTAG_FLAG_AD_MASK;
+	if (iinfo->i_alloc_type != ICBTAG_FLAG_AD_SHORT &&
+	    iinfo->i_alloc_type != ICBTAG_FLAG_AD_LONG &&
+	    iinfo->i_alloc_type != ICBTAG_FLAG_AD_IN_ICB) {
+		ret = -EIO;
+		goto out;
+	}
 	iinfo->i_unique = 0;
 	iinfo->i_lenEAttr = 0;
 	iinfo->i_lenExtents = 0;