partitions/efi: Fix integer overflow in GPT size calculation

[sagit-ice-cold/kernel_xiaomi_msm8998.git] / block / partitions / efi.c

diff --git a/block/partitions/efi.c b/block/partitions/efi.c
index 26cb624..d26d0d2 100644 (file)
--- a/block/partitions/efi.c
+++ b/block/partitions/efi.c
@@ -293,7 +293,7 @@ static gpt_entry *alloc_read_gpt_entries(struct parsed_partitions *state,
        if (!gpt)
                return NULL;
 
-       count = le32_to_cpu(gpt->num_partition_entries) *
+       count = (size_t)le32_to_cpu(gpt->num_partition_entries) *
                 le32_to_cpu(gpt->sizeof_partition_entry);
        if (!count)
                return NULL;
@@ -352,7 +352,7 @@ static int is_gpt_valid(struct parsed_partitions *state, u64 lba,
                        gpt_header **gpt, gpt_entry **ptes)
 {
        u32 crc, origcrc;
-       u64 lastlba;
+       u64 lastlba, pt_size;
 
        if (!ptes)
                return 0;
@@ -434,13 +434,20 @@ static int is_gpt_valid(struct parsed_partitions *state, u64 lba,
                goto fail;
        }
 
+       /* Sanity check partition table size */
+       pt_size = (u64)le32_to_cpu((*gpt)->num_partition_entries) *
+               le32_to_cpu((*gpt)->sizeof_partition_entry);
+       if (pt_size > KMALLOC_MAX_SIZE) {
+               pr_debug("GUID Partition Table is too large: %llu > %lu bytes\n",
+                        (unsigned long long)pt_size, KMALLOC_MAX_SIZE);
+               goto fail;
+       }
+
        if (!(*ptes = alloc_read_gpt_entries(state, *gpt)))
                goto fail;
 
        /* Check the GUID Partition Entry Array CRC */
-       crc = efi_crc32((const unsigned char *) (*ptes),
-                       le32_to_cpu((*gpt)->num_partition_entries) *
-                       le32_to_cpu((*gpt)->sizeof_partition_entry));
+       crc = efi_crc32((const unsigned char *) (*ptes), pt_size);
 
        if (crc != le32_to_cpu((*gpt)->partition_entry_array_crc32)) {
                pr_debug("GUID Partitition Entry Array CRC check failed.\n");