[SECURITY PATCH 093/117] fs/btrfs: Validate the number of stripes/parities in RAID5/6

[Daniel Kiper]

From: Daniel Axtens <dja@axtens.net>

This prevents a divide by zero if nstripes == nparities, and
also prevents propagation of invalid values if nstripes ends up
less than nparities.

Signed-off-by: Daniel Axtens <dja@axtens.net>
Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
---
 grub-core/fs/btrfs.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/grub-core/fs/btrfs.c b/grub-core/fs/btrfs.c
index 27339bdb3..c4ba5f110 100644
--- a/grub-core/fs/btrfs.c
+++ b/grub-core/fs/btrfs.c
@@ -1083,6 +1083,9 @@ grub_btrfs_read_logical (struct grub_btrfs_data *data, 
grub_disk_addr_t addr,
               * stripen is computed without the parities
               * (0 for A0, A1, A2, 1 for B0, B1, B2, etc.).
               */
+             if (nparities >= nstripes)
+               return grub_error (GRUB_ERR_BAD_FS,
+                                  "invalid RAID5/6: nparities >= nstripes");
              high = grub_divmod64 (stripe_nr, nstripes - nparities, &stripen);
 
              /*
-- 
2.11.0