linux-stable.git/fs/udf, branch linux-6.10.y

udf: Avoid excessive partition lengths

2024-09-12T09:12:51+00:00

[ Upstream commit ebbe26fd54a9621994bc16b14f2ba8f84c089693 ]

Avoid mounting filesystems where the partition would overflow the
32-bits used for block number. Also refuse to mount filesystems where
the partition length is so large we cannot safely index bits in a
block bitmap.

Link: https://patch.msgid.link/20240620130403.14731-1-jack@suse.cz
Signed-off-by: Jan Kara 
Signed-off-by: Sasha Levin

udf: prevent integer overflow in udf_bitmap_free_blocks()

2024-08-14T13:34:10+00:00

[ Upstream commit 56e69e59751d20993f243fb7dd6991c4e522424c ]

An overflow may occur if the function is called with the last
block and an offset greater than zero. It is necessary to add
a check to avoid this.

Found by Linux Verification Center (linuxtesting.org) with Svace.

[JK: Make test cover also unalloc table freeing]

Link: https://patch.msgid.link/20240620072413.7448-1-r.smirnov@omp.ru
Suggested-by: Jan Kara 
Signed-off-by: Roman Smirnov 
Signed-off-by: Jan Kara 
Signed-off-by: Sasha Levin

udf: Avoid using corrupted block bitmap buffer

2024-08-03T07:00:36+00:00

commit a90d4471146de21745980cba51ce88e7926bcc4f upstream.

When the filesystem block bitmap is corrupted, we detect the corruption
while loading the bitmap and fail the allocation with error. However the
next allocation from the same bitmap will notice the bitmap buffer is
already loaded and tries to allocate from the bitmap with mixed results
(depending on the exact nature of the bitmap corruption). Fix the
problem by using BH_verified bit to indicate whether the bitmap is valid
or not.

Reported-by: syzbot+5f682cd029581f9edfd1@syzkaller.appspotmail.com
CC: stable@vger.kernel.org
Link: https://patch.msgid.link/20240617154201.29512-2-jack@suse.cz
Fixes: 1e0d4adf17e7 ("udf: Check consistency of Space Bitmap Descriptor")
Signed-off-by: Jan Kara 
Signed-off-by: Greg Kroah-Hartman

udf: Fix bogus checksum computation in udf_rename()

2024-08-03T06:59:39+00:00

[ Upstream commit 27ab33854873e6fb958cb074681a0107cc2ecc4c ]

Syzbot reports uninitialized memory access in udf_rename() when updating
checksum of '..' directory entry of a moved directory. This is indeed
true as we pass on-stack diriter.fi to the udf_update_tag() and because
that has only struct fileIdentDesc included in it and not the impUse or
name fields, the checksumming function is going to checksum random stack
contents beyond the end of the structure. This is actually harmless
because the following udf_fiiter_write_fi() will recompute the checksum
from on-disk buffers where everything is properly included. So all that
is needed is just removing the bogus calculation.

Fixes: e9109a92d2a9 ("udf: Convert udf_rename() to new directory iteration code")
Link: https://lore.kernel.org/all/000000000000cf405f060d8f75a9@google.com/T/
Link: https://patch.msgid.link/20240617154201.29512-1-jack@suse.cz
Reported-by: syzbot+d31185aa54170f7fc1f5@syzkaller.appspotmail.com
Signed-off-by: Jan Kara 
Signed-off-by: Sasha Levin

udf: Fix lock ordering in udf_evict_inode()

2024-08-03T06:59:36+00:00

[ Upstream commit 8832fc1e502687869606bb0a7b79848ed3bf036f ]

udf_evict_inode() calls udf_setsize() to truncate deleted inode.
However inode deletion through udf_evict_inode() can happen from inode
reclaim context and udf_setsize() grabs mapping->invalidate_lock which
isn't generally safe to acquire from fs reclaim context since we
allocate pages under mapping->invalidate_lock for example in a page
fault path.  This is however not a real deadlock possibility as by the
time udf_evict_inode() is called, nobody can be accessing the inode,
even less work with its page cache. So this is just a lockdep triggering
false positive. Fix the problem by moving mapping->invalidate_lock
locking outsize of udf_setsize() into udf_setattr() as grabbing
mapping->invalidate_lock from udf_evict_inode() is pointless.

Reported-by: syzbot+0333a6f4b88bcd68a62f@syzkaller.appspotmail.com
Fixes: b9a861fd527a ("udf: Protect truncate and file type conversion with invalidate_lock")
Signed-off-by: Jan Kara 
Signed-off-by: Sasha Levin

udf: Use a folio in udf_write_end()

2024-04-23T13:37:02+00:00

Convert the page to a folio and use the folio APIs.  Replaces three
calls to compound_head() with one.

Signed-off-by: Matthew Wilcox (Oracle) 
Signed-off-by: Jan Kara 
Message-Id: <20240417150416.752929-8-willy@infradead.org>

udf: Convert udf_page_mkwrite() to use a folio

2024-04-23T13:37:02+00:00

Convert the vm_fault page to a folio, then use it throughout.
Replaces five calls to compound_head() with one.

Signed-off-by: Matthew Wilcox (Oracle) 
Signed-off-by: Jan Kara 
Message-Id: <20240417150416.752929-7-willy@infradead.org>

udf: Convert udf_symlink_getattr() to use a folio

2024-04-23T13:37:02+00:00

We're getting this from the page cache, so it's definitely a folio.
Saves a call to compound_head() hidden in put_page().

Signed-off-by: Matthew Wilcox (Oracle) 
Signed-off-by: Jan Kara 
Message-Id: <20240417150416.752929-6-willy@infradead.org>

udf: Convert udf_adinicb_readpage() to udf_adinicb_read_folio()

2024-04-23T13:37:02+00:00

Now that all three callers have a folio, convert this function to
take a folio, and use the folio APIs.

Signed-off-by: Matthew Wilcox (Oracle) 
Signed-off-by: Jan Kara 
Message-Id: <20240417150416.752929-5-willy@infradead.org>

udf: Convert udf_expand_file_adinicb() to use a folio

2024-04-23T13:36:30+00:00

Use the folio APIs throughout this function.

Signed-off-by: Matthew Wilcox (Oracle) 
Fixes: 1eeceaec794e ("udf: Convert udf_expand_file_adinicb() to avoid kmap_atomic()")
Signed-off-by: Jan Kara 
Message-Id: <20240417150416.752929-4-willy@infradead.org>