mac: validate mac_partition is within sector
authorKees Cook <keescook@chromium.org>
Fri, 20 Nov 2015 01:18:54 +0000 (17:18 -0800)
committerBen Hutchings <ben@decadent.org.uk>
Wed, 30 Dec 2015 02:25:56 +0000 (02:25 +0000)
commit81a319c5c29913a23947f3d28513974682f3af03
treebfe8b4928304513b7c3a320442a70a4a81cf8b06
parent645fd470312a5327fbe39d7343af390330d5003c
mac: validate mac_partition is within sector

commit 02e2a5bfebe99edcf9d694575a75032d53fe1b73 upstream.

If md->signature == MAC_DRIVER_MAGIC and md->block_size == 1023, a single
512 byte sector would be read (secsize / 512). However the partition
structure would be located past the end of the buffer (secsize % 512).

Signed-off-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Jens Axboe <axboe@fb.com>
[bwh: Backported to 3.2: adjust filename]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
fs/partitions/mac.c