udf: Avoid infinite loop when processing indirect ICBs
authorJan Kara <jack@suse.cz>
Thu, 4 Sep 2014 12:06:55 +0000 (14:06 +0200)
committerBen Hutchings <ben@decadent.org.uk>
Thu, 1 Jan 2015 01:27:49 +0000 (01:27 +0000)
commit7ecef8c8b70c21c944ccdf8b8406292e71038a98
treefd8e4fb03e510b32275f3d4f26cbdab5b2eaf44b
parenteff3ef9a83145917ccbabc07e0289c388b24600c
udf: Avoid infinite loop when processing indirect ICBs

commit c03aa9f6e1f938618e6db2e23afef0574efeeb65 upstream.

We did not implement any bound on number of indirect ICBs we follow when
loading inode. Thus corrupted medium could cause kernel to go into an
infinite loop, possibly causing a stack overflow.

Fix the possible stack overflow by removing recursion from
__udf_read_inode() and limit number of indirect ICBs we follow to avoid
infinite loops.

Signed-off-by: Jan Kara <jack@suse.cz>
[bwh: Backported to 3.2: adjust context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
fs/udf/inode.c