isofs: Fix infinite looping over CE entries
authorJan Kara <jack@suse.cz>
Mon, 15 Dec 2014 13:22:46 +0000 (14:22 +0100)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Thu, 8 Jan 2015 17:58:15 +0000 (09:58 -0800)
commit1fe5620fcd6c2f0a4a927ee10c8e53196da392f3
tree8b4f7bca6bdeafd8d3be7cd1f1c77f786098fcf1
parenta472efc75989c7092187fe00f0400e02c495c436
isofs: Fix infinite looping over CE entries

commit f54e18f1b831c92f6512d2eedb224cd63d607d3d upstream.

Rock Ridge extensions define so called Continuation Entries (CE) which
define where is further space with Rock Ridge data. Corrupted isofs
image can contain arbitrarily long chain of these, including a one
containing loop and thus causing kernel to end in an infinite loop when
traversing these entries.

Limit the traversal to 32 entries which should be more than enough space
to store all the Rock Ridge data.

Reported-by: P J P <ppandit@redhat.com>
Signed-off-by: Jan Kara <jack@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
fs/isofs/rock.c