Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 9afadc4b authored by Jan Kara's avatar Jan Kara Committed by Jan Kara
Browse files

udf: Fix memory corruption when fs mounted with noadinicb option 



When UDF filesystem is mounted with noadinicb mount option, it
happens that we extend an empty directory with a block. A code in
udf_add_entry() didn't count with this possibility and used
uninitialized data leading to memory and filesystem corruption.
Add a check whether file already has some extents before operating
on them.

Signed-off-by: default avatarJan Kara <jack@suse.cz>
parent 221e583a

fs/udf/namei.c

+3 −2
Original line number Diff line number Diff line
@@ -315,7 +315,7 @@ static struct fileIdentDesc *udf_add_entry(struct inode *dir, 
	uint16_t liu;

	int block;

	kernel_lb_addr eloc;

	uint32_t elen;

	uint32_t elen = 0;

	sector_t offset;

	struct extent_position epos = {};

	struct udf_inode_info *dinfo;
@@ -406,7 +406,8 @@ static struct fileIdentDesc *udf_add_entry(struct inode *dir, 
	}



add:

	if (dinfo->i_alloc_type != ICBTAG_FLAG_AD_IN_ICB) {

	/* Is there any extent whose size we need to round up? */

	if (dinfo->i_alloc_type != ICBTAG_FLAG_AD_IN_ICB && elen) {

		elen = (elen + sb->s_blocksize - 1) & ~(sb->s_blocksize - 1);

		if (dinfo->i_alloc_type == ICBTAG_FLAG_AD_SHORT)

			epos.offset -= sizeof(short_ad);