diff options
| author | Daniel P. Berrangé | 2022-09-05 14:50:03 +0200 |
|---|---|---|
| committer | Daniel P. Berrangé | 2022-10-27 13:55:27 +0200 |
| commit | d233fbc327d3f1f03bc30e0486b9ade3aa23f9ec (patch) | |
| tree | 9c53221037e0f325e26bfce8abeeaa11d4feb420 | |
| parent | crypto: enforce that key material doesn't overlap with LUKS header (diff) | |
| download | qemu-d233fbc327d3f1f03bc30e0486b9ade3aa23f9ec.tar.gz qemu-d233fbc327d3f1f03bc30e0486b9ade3aa23f9ec.tar.xz qemu-d233fbc327d3f1f03bc30e0486b9ade3aa23f9ec.zip | |
crypto: validate that LUKS payload doesn't overlap with header
We already validate that LUKS keyslots don't overlap with the
header, or with each other. This closes the remaining hole in
validation of LUKS file regions.
Reviewed-by: Richard W.M. Jones <rjones@redhat.com>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
| -rw-r--r-- | crypto/block-luks.c | 7 |
1 files changed, 7 insertions, 0 deletions
diff --git a/crypto/block-luks.c b/crypto/block-luks.c index 6ef9a89ffa..f22bc63e54 100644 --- a/crypto/block-luks.c +++ b/crypto/block-luks.c @@ -572,6 +572,13 @@ qcrypto_block_luks_check_header(const QCryptoBlockLUKS *luks, Error **errp) return -1; } + if (luks->header.payload_offset_sector < + DIV_ROUND_UP(QCRYPTO_BLOCK_LUKS_KEY_SLOT_OFFSET, + QCRYPTO_BLOCK_LUKS_SECTOR_SIZE)) { + error_setg(errp, "LUKS payload is overlapping with the header"); + return -1; + } + /* Check all keyslots for corruption */ for (i = 0 ; i < QCRYPTO_BLOCK_LUKS_NUM_KEY_SLOTS ; i++) { |