linux-stable.git/fs/udf, branch linux-3.4.y

udf: Check length of extended attributes and allocation descriptors

2015-09-18T01:20:45+00:00

commit 23b133bdc452aa441fcb9b82cbf6dd05cfd342d0 upstream.

Check length of extended attributes and allocation descriptors when
loading inodes from disk. Otherwise corrupted filesystems could confuse
the code and make the kernel oops.

Reported-by: Carl Henrik Lunde 
Signed-off-by: Jan Kara 
[lizf: Backported to 3.4:
 - call make_bad_inode() and then return
 - relace bs with inode->i_sb->s_blocksize]
Signed-off-by: Zefan Li

udf: Check component length before reading it

2015-04-14T09:33:48+00:00

commit e237ec37ec154564f8690c5bd1795339955eeef9 upstream.

Check that length specified in a component of a symlink fits in the
input buffer we are reading. Also properly ignore component length for
component types that do not use it. Otherwise we read memory after end
of buffer for corrupted udf image.

Reported-by: Carl Henrik Lunde 
Signed-off-by: Jan Kara 
Signed-off-by: Zefan Li

udf: Check path length when reading symlink

2015-04-14T09:33:48+00:00

commit 0e5cc9a40ada6046e6bc3bdfcd0c0d7e4b706b14 upstream.

Symlink reading code does not check whether the resulting path fits into
the page provided by the generic code. This isn't as easy as just
checking the symlink size because of various encoding conversions we
perform on path. So we have to check whether there is still enough space
in the buffer on the fly.

Reported-by: Carl Henrik Lunde 
Signed-off-by: Jan Kara 
[lizf: Backported to 3.4: udf_get_filename() is called in do_udf_readdir()]
Signed-off-by: Zefan Li

udf: Verify symlink size before loading it

2015-04-14T09:33:48+00:00

commit a1d47b262952a45aae62bd49cfaf33dd76c11a2c upstream.

UDF specification allows arbitrarily large symlinks. However we support
only symlinks at most one block large. Check the length of the symlink
so that we don't access memory beyond end of the symlink block.

Reported-by: Carl Henrik Lunde 
Signed-off-by: Jan Kara 
Signed-off-by: Zefan Li

udf: Verify i_size when loading inode

2015-04-14T09:33:47+00:00

commit e159332b9af4b04d882dbcfe1bb0117f0a6d4b58 upstream.

Verify that inode size is sane when loading inode with data stored in
ICB. Otherwise we may get confused later when working with the inode and
inode size is too big.

Reported-by: Carl Henrik Lunde 
Signed-off-by: Jan Kara 
[lizf: Backported to 3.4: just return on error, as there's no "out" label]
Signed-off-by: Zefan Li

udf: avoid info leak on export

2013-03-28T19:12:27+00:00

commit 0143fc5e9f6f5aad4764801015bc8d4b4a278200 upstream.

For type 0x51 the udf.parent_partref member in struct fid gets copied
uninitialized to userland. Fix this by initializing it to 0.

Signed-off-by: Mathias Krause 
Signed-off-by: Jan Kara 
Cc: Ben Hutchings 
Signed-off-by: Greg Kroah-Hartman

udf: Fix bitmap overflow on large filesystems with small block size

2013-03-28T19:12:27+00:00

commit 89b1f39eb4189de745fae554b0d614d87c8d5c63 upstream.

For large UDF filesystems with 512-byte blocks the number of necessary
bitmap blocks is larger than 2^16 so s_nr_groups in udf_bitmap overflows
(the number will overflow for filesystems larger than 128 GB with
512-byte blocks). That results in ENOSPC errors despite the filesystem
has plenty of free space.

Fix the problem by changing s_nr_groups' type to 'int'. That is enough
even for filesystems 2^32 blocks (UDF maximum) and 512-byte blocksize.

Reported-and-tested-by: v10lator@myway.de
Signed-off-by: Jan Kara 
Cc: Jim Trigg 
Signed-off-by: Greg Kroah-Hartman

udf: don't increment lenExtents while writing to a hole

2013-01-17T16:50:53+00:00

commit fb719c59bdb4fca86ee1fd1f42ab3735ca12b6b2 upstream.

Incrementing lenExtents even while writing to a hole is bad
for performance as calls to udf_discard_prealloc and
udf_truncate_tail_extent would not return from start if
isize != lenExtents

Signed-off-by: Namjae Jeon 
Signed-off-by: Ashish Sangwan 
Signed-off-by: Jan Kara 
Signed-off-by: Shuah Khan 
Signed-off-by: Greg Kroah-Hartman

udf: fix memory leak while allocating blocks during write

2013-01-17T16:50:53+00:00

commit 2fb7d99d0de3fd8ae869f35ab682581d8455887a upstream.

Need to brelse the buffer_head stored in cur_epos and next_epos.

Signed-off-by: Namjae Jeon 
Signed-off-by: Ashish Sangwan 
Signed-off-by: Jan Kara 
Signed-off-by: Shuah Khan 
Signed-off-by: Greg Kroah-Hartman

udf: fix retun value on error path in udf_load_logicalvol

2012-10-12T20:39:00+00:00

commit 68766a2edcd5cd744262a70a2f67a320ac944760 upstream.

In case we detect a problem and bail out, we fail to set "ret" to a
nonzero value, and udf_load_logicalvol will mistakenly report success.

Signed-off-by: Nikola Pajkovsky 
Signed-off-by: Jan Kara 
Cc: Herton Ronaldo Krzesinski 
Signed-off-by: Greg Kroah-Hartman