linux-stable.git/fs/udf, branch v3.2.33

udf: fix retun value on error path in udf_load_logicalvol

2012-10-17T02:49:50+00:00

commit 68766a2edcd5cd744262a70a2f67a320ac944760 upstream.

In case we detect a problem and bail out, we fail to set "ret" to a
nonzero value, and udf_load_logicalvol will mistakenly report success.

Signed-off-by: Nikola Pajkovsky 
Signed-off-by: Jan Kara 
Signed-off-by: Ben Hutchings

udf: Fix data corruption for files in ICB

2012-09-19T14:04:43+00:00

commit 9c2fc0de1a6e638fe58c354a463f544f42a90a09 upstream.

When a file is stored in ICB (inode), we overwrite part of the file, and
the page containing file's data is not in page cache, we end up corrupting
file's data by overwriting them with zeros. The problem is we use
simple_write_begin() which simply zeroes parts of the page which are not
written to. The problem has been introduced by be021ee4 (udf: convert to
new aops).

Fix the problem by providing a ->write_begin function which makes the page
properly uptodate.

Reported-by: Ian Abbott 
Signed-off-by: Jan Kara 
Signed-off-by: Ben Hutchings

udf: Improve table length check to avoid possible overflow

2012-08-02T13:37:46+00:00

commit 57b9655d01ef057a523e810d29c37ac09b80eead upstream.

When a partition table length is corrupted to be close to 1 << 32, the
check for its length may overflow on 32-bit systems and we will think
the length is valid. Later on the kernel can crash trying to read beyond
end of buffer. Fix the check to avoid possible overflow.

Reported-by: Ben Hutchings 
Signed-off-by: Jan Kara 
Signed-off-by: Ben Hutchings

udf: Fortify loading of sparing table

2012-07-12T03:32:10+00:00

commit 1df2ae31c724e57be9d7ac00d78db8a5dabdd050 upstream.

Add sanity checks when loading sparing table from disk to avoid accessing
unallocated memory or writing to it.

Signed-off-by: Jan Kara 
Signed-off-by: Ben Hutchings

udf: Avoid run away loop when partition table length is corrupted

2012-07-12T03:32:10+00:00

commit adee11b2085bee90bd8f4f52123ffb07882d6256 upstream.

Check provided length of partition table so that (possibly maliciously)
corrupted partition table cannot cause accessing data beyond current buffer.

Signed-off-by: Jan Kara 
Signed-off-by: Ben Hutchings

udf: Use 'ret' instead of abusing 'i' in udf_load_logicalvol()

2012-07-12T03:32:10+00:00

commit cb14d340ef1737c24125dd663eff77734a482d47 upstream.

Signed-off-by: Jan Kara 
Signed-off-by: Ben Hutchings

udf: Fix deadlock in udf_release_file()

2012-04-02T16:53:04+00:00

commit a0391a3ae91d301c0e59368531a4de5f0b122bcf upstream.

udf_release_file() can be called from munmap() path with mmap_sem held.  Thus
we cannot take i_mutex there because that ranks above mmap_sem. Luckily,
i_mutex is not needed in udf_release_file() anymore since protection by
i_data_sem is enough to protect from races with write and truncate.

Reported-by: Al Viro 
Reviewed-by: Namjae Jeon 
Signed-off-by: Jan Kara 
Signed-off-by: Greg Kroah-Hartman

udf: Mark LVID buffer as uptodate before marking it dirty

2012-02-13T19:16:56+00:00

commit 853a0c25baf96b028de1654bea1e0c8857eadf3d upstream.

When we hit EIO while writing LVID, the buffer uptodate bit is cleared.
This then results in an anoying warning from mark_buffer_dirty() when we
write the buffer again. So just set uptodate flag unconditionally.

Reviewed-by: Namjae Jeon 
Signed-off-by: Jan Kara 
Cc: Dave Jones 
Signed-off-by: Greg Kroah-Hartman

udf: Fix deadlock when converting file from in-ICB one to normal one

2012-01-12T19:29:37+00:00

commit d2eb8c359309ec45d6bf5b147303ab8e13be86ea upstream.

During BKL removal in 2.6.38, conversion of files from in-ICB format to normal
format got broken. We call ->writepage with i_data_sem held but udf_get_block()
also acquires i_data_sem thus creating A-A deadlock.

We fix the problem by dropping i_data_sem before calling ->writepage() which is
safe since i_mutex still protects us against any changes in the file. Also fix
pagelock - i_data_sem lock inversion in udf_expand_file_adinicb() by dropping
i_data_sem before calling find_or_create_page().

Reported-by: Matthias Matiak 
Tested-by: Matthias Matiak 
Reviewed-by: Namjae Jeon 
Signed-off-by: Jan Kara 
Signed-off-by: Greg Kroah-Hartman

Merge branch 'for-next' of git://git.kernel.org/pub/scm/linux/kernel/git/hch/vfs-queue

2011-11-02T18:41:01+00:00

* 'for-next' of git://git.kernel.org/pub/scm/linux/kernel/git/hch/vfs-queue:
  vfs: add d_prune dentry operation
  vfs: protect i_nlink
  filesystems: add set_nlink()
  filesystems: add missing nlink wrappers
  logfs: remove unnecessary nlink setting
  ocfs2: remove unnecessary nlink setting
  jfs: remove unnecessary nlink setting
  hypfs: remove unnecessary nlink setting
  vfs: ignore error on forced remount
  readlinkat: ensure we return ENOENT for the empty pathname for normal lookups
  vfs: fix dentry leak in simple_fill_super()