linux.git/fs/omfs, branch v4.6

omfs: fix potential integer overflow in allocator

2015-05-29T01:25:19+00:00

Both 'i' and 'bits_per_entry' are signed integers but the result is a
u64 block number.  Cast i to u64 to avoid truncation on 32-bit targets.

Found by Coverity (CID 200679).

Signed-off-by: Bob Copeland 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

omfs: fix sign confusion for bitmap loop counter

2015-05-29T01:25:19+00:00

The count variable is used to iterate down to (below) zero from the size
of the bitmap and handle the one-filling the remainder of the last
partial bitmap block.  The loop conditional expects count to be signed
in order to detect when the final block is processed, after which count
goes negative.

Unfortunately, a recent change made this unsigned along with some other
related fields.  The result of is this is that during mount,
omfs_get_imap will overrun the bitmap array and corrupt memory unless
number of blocks happens to be a multiple of 8 * blocksize.

Fix by changing count back to signed: it is guaranteed to fit in an s32
without overflow due to an enforced limit on the number of blocks in the
filesystem.

Signed-off-by: Bob Copeland 
Cc: 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

omfs: set error return when d_make_root() fails

2015-05-29T01:25:18+00:00

A static checker found the following issue in the error path for
omfs_fill_super:

    fs/omfs/inode.c:552 omfs_fill_super()
    warn: missing error code here? 'd_make_root()' failed. 'ret' = '0'

Fix by returning -ENOMEM in this case.

Signed-off-by: Bob Copeland 
Reported-by: Dan Carpenter 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

fs, omfs: add NULL terminator in the end up the token list

2015-05-29T01:25:18+00:00

match_token() expects a NULL terminator at the end of the token list so
that it would know where to stop.  Not having one causes it to overrun
to invalid memory.

In practice, passing a mount option that omfs didn't recognize would
sometimes panic the system.

Signed-off-by: Sasha Levin 
Signed-off-by: Bob Copeland 
Cc: 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

VFS: normal filesystems (and lustre): d_inode() annotations

2015-04-15T19:06:57+00:00

that's the bulk of filesystem drivers dealing with inodes of their own

Signed-off-by: David Howells 
Signed-off-by: Al Viro

make new_sync_{read,write}() static

2015-04-12T02:29:40+00:00

All places outside of core VFS that checked ->read and ->write for being NULL or
called the methods directly are gone now, so NULL {read,write} with non-NULL
{read,write}_iter will do the right thing in all cases.

Signed-off-by: Al Viro

FS/OMFS: block number sanity check during fill_super operation

2014-10-14T00:18:22+00:00

This patch defines maximum block number to 2^31.  It also converts
bitmap_size and array_size to unsigned int in omfs_get_imap

Signed-off-by: Fabian Frederick 
Suggested-by: Linus Torvalds 
Suggested-by: Bob Copeland 
Acked-by: Bob Copeland 
Tested-by: Bob Copeland 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

fs/omfs/inode.c: replace count*size kzalloc by kcalloc

2014-08-08T22:57:25+00:00

kcalloc manages count*sizeof overflow.

Signed-off-by: Fabian Frederick 
Acked-by: Bob Copeland 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

write_iter variants of {__,}generic_file_aio_write()

2014-05-06T21:38:00+00:00

Signed-off-by: Al Viro

switch simple generic_file_aio_read() users to ->read_iter()

2014-05-06T21:37:55+00:00

Signed-off-by: Al Viro