From 8a08c34aad61cb59c977212458bf55f5a81186e8 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Thomas=20Wei=C3=9Fschuh?= <thomas@t-8ch.de>
Date: Thu, 2 Mar 2023 15:54:39 +0000
Subject: [PATCH] libblkid: nvidia_raid: validate checksum
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

See #1843

Signed-off-by: Thomas Weißschuh <thomas@t-8ch.de>
---
 libblkid/src/superblocks/nvidia_raid.c | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

diff --git a/libblkid/src/superblocks/nvidia_raid.c b/libblkid/src/superblocks/nvidia_raid.c
index 35c663c8d..f59a0e100 100644
--- a/libblkid/src/superblocks/nvidia_raid.c
+++ b/libblkid/src/superblocks/nvidia_raid.c
@@ -27,6 +27,14 @@ struct nv_metadata {
 #define NVIDIA_SUPERBLOCK_SIZE		120
 
 
+static int nvraid_verify_checksum(blkid_probe pr, const struct nv_metadata *nv)
+{
+	uint32_t csum = le32_to_cpu(nv->chksum);
+	for (size_t i = 0; i < le32_to_cpu(nv->size); i++)
+		csum += le32_to_cpu(((uint32_t *) nv)[i]);
+	return blkid_probe_verify_csum(pr, csum, le32_to_cpu(nv->chksum));
+}
+
 static int probe_nvraid(blkid_probe pr,
 		const struct blkid_idmag *mag __attribute__((__unused__)))
 {
@@ -42,7 +50,7 @@ static int probe_nvraid(blkid_probe pr,
 	nv = (struct nv_metadata *)
 		blkid_probe_get_buffer(pr,
 				off,
-				sizeof(struct nv_metadata));
+				NVIDIA_SUPERBLOCK_SIZE);
 	if (!nv)
 		return errno ? -errno : 1;
 
@@ -50,6 +58,8 @@ static int probe_nvraid(blkid_probe pr,
 		return 1;
 	if (le32_to_cpu(nv->size) * 4 != NVIDIA_SUPERBLOCK_SIZE)
 		return 1;
+	if (!nvraid_verify_checksum(pr, nv))
+		return 1;
 	if (blkid_probe_sprintf_version(pr, "%u", le16_to_cpu(nv->version)) != 0)
 		return 1;
 	if (blkid_probe_set_magic(pr, off, sizeof(nv->vendor),
-- 
2.27.0

