From 120ec50984b8645232c2c004310dd94ceff5520e Mon Sep 17 00:00:00 2001 From: Kyle Zeng Date: Fri, 12 Jun 2026 15:58:46 -0700 Subject: [PATCH] udf: validate extent partition references in udf_current_aext() Long allocation descriptors carry an on-disk extLocation.partitionReferenceNum. udf_current_aext() copies that value into a kernel_lb_addr and returns it to several consumers. If the partition reference is outside s_partitions, callers can later index s_partmaps out of bounds. The truncate/free path can pass such an extent to udf_free_blocks(), where the invalid partition reference causes a slab out-of-bounds read. Validate eloc->partitionReferenceNum in udf_current_aext() before returning a decoded extent. This rejects invalid file extents and indirect allocation descriptor extents in the common parser, so callers do not need to duplicate the partition-map bounds check. Assisted-by: Codex:gpt-5.5 Signed-off-by: Kyle Zeng Link: https://patch.msgid.link/20260612225846.97678-1-kylebot@openai.com Signed-off-by: Jan Kara --- fs/udf/inode.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/fs/udf/inode.c b/fs/udf/inode.c index 67bcf83758c8..c4a08e8bc1c9 100644 --- a/fs/udf/inode.c +++ b/fs/udf/inode.c @@ -2299,6 +2299,13 @@ int udf_current_aext(struct inode *inode, struct extent_position *epos, return -EINVAL; } + if (eloc->partitionReferenceNum >= UDF_SB(inode->i_sb)->s_partitions) { + udf_debug("invalid partition reference %u (partitions %u)\n", + eloc->partitionReferenceNum, + UDF_SB(inode->i_sb)->s_partitions); + return -EFSCORRUPTED; + } + return 1; }