From: Kinglong Mee <kinglongmee@gmail.com>
Date: Wed, 15 Mar 2017 13:12:50 +0000 (+0800)
Subject: f2fs: sanity check of crc_offset from raw checkpoint
X-Git-Url: https://git.stricted.de/?a=commitdiff_plain;h=c6f89dfd528041de2e71788495579a18c0363869;p=GitHub%2FLineageOS%2Fandroid_kernel_motorola_exynos9610.git

f2fs: sanity check of crc_offset from raw checkpoint

The crc_offset towards or beyond the end of block is wrong,
sanity check it.

Signed-off-by: Kinglong Mee <kinglongmee@gmail.com>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
---

diff --git a/fs/f2fs/checkpoint.c b/fs/f2fs/checkpoint.c
index 22348c7df67d..7dd7dd5914c5 100644
--- a/fs/f2fs/checkpoint.c
+++ b/fs/f2fs/checkpoint.c
@@ -678,7 +678,7 @@ static int get_checkpoint_version(struct f2fs_sb_info *sbi, block_t cp_addr,
 	*cp_block = (struct f2fs_checkpoint *)page_address(*cp_page);
 
 	crc_offset = le32_to_cpu((*cp_block)->checksum_offset);
-	if (crc_offset >= blk_size) {
+	if (crc_offset > (blk_size - sizeof(__le32))) {
 		f2fs_msg(sbi->sb, KERN_WARNING,
 			"invalid crc_offset: %zu", crc_offset);
 		return -EINVAL;