Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit b9d4a35f authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge branch 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs 

Pull UDF & isofs fixes from Jan Kara:
 "A couple of UDF fixes of handling of corrupted media and one iso9660
  fix of the same"

* 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs:
  udf: Reduce repeated dereferences
  udf: Check component length before reading it
  udf: Check path length when reading symlink
  udf: Verify symlink size before loading it
  udf: Verify i_size when loading inode
  isofs: Fix unchecked printing of ER records
parents df90dcd1 3ee3039c

fs/isofs/rock.c

+3 −0
Original line number Diff line number Diff line
@@ -362,6 +362,9 @@ parse_rock_ridge_inode_internal(struct iso_directory_record *de, 
			rs.cont_size = isonum_733(rr->u.CE.size);

			break;

		case SIG('E', 'R'):

			/* Invalid length of ER tag id? */

			if (rr->u.ER.len_id + offsetof(struct rock_ridge, u.ER.data) > rr->len)

				goto out;

			ISOFS_SB(inode->i_sb)->s_rock = 1;

			printk(KERN_DEBUG "ISO 9660 Extensions: ");

			{

fs/udf/dir.c

+16 −15
Original line number Diff line number Diff line
@@ -57,6 +57,7 @@ static int udf_readdir(struct file *file, struct dir_context *ctx) 
	sector_t offset;

	int i, num, ret = 0;

	struct extent_position epos = { NULL, 0, {0, 0} };

	struct super_block *sb = dir->i_sb;



	if (ctx->pos == 0) {

		if (!dir_emit_dot(file, ctx))
@@ -76,16 +77,16 @@ static int udf_readdir(struct file *file, struct dir_context *ctx) 
	if (nf_pos == 0)

		nf_pos = udf_ext0_offset(dir);



	fibh.soffset = fibh.eoffset = nf_pos & (dir->i_sb->s_blocksize - 1);

	fibh.soffset = fibh.eoffset = nf_pos & (sb->s_blocksize - 1);

	if (iinfo->i_alloc_type != ICBTAG_FLAG_AD_IN_ICB) {

		if (inode_bmap(dir, nf_pos >> dir->i_sb->s_blocksize_bits,

		if (inode_bmap(dir, nf_pos >> sb->s_blocksize_bits,

		    &epos, &eloc, &elen, &offset)

		    != (EXT_RECORDED_ALLOCATED >> 30)) {

			ret = -ENOENT;

			goto out;

		}

		block = udf_get_lb_pblock(dir->i_sb, &eloc, offset);

		if ((++offset << dir->i_sb->s_blocksize_bits) < elen) {

		block = udf_get_lb_pblock(sb, &eloc, offset);

		if ((++offset << sb->s_blocksize_bits) < elen) {

			if (iinfo->i_alloc_type == ICBTAG_FLAG_AD_SHORT)

				epos.offset -= sizeof(struct short_ad);

			else if (iinfo->i_alloc_type ==
@@ -95,18 +96,18 @@ static int udf_readdir(struct file *file, struct dir_context *ctx) 
			offset = 0;

		}



		if (!(fibh.sbh = fibh.ebh = udf_tread(dir->i_sb, block))) {

		if (!(fibh.sbh = fibh.ebh = udf_tread(sb, block))) {

			ret = -EIO;

			goto out;

		}



		if (!(offset & ((16 >> (dir->i_sb->s_blocksize_bits - 9)) - 1))) {

			i = 16 >> (dir->i_sb->s_blocksize_bits - 9);

			if (i + offset > (elen >> dir->i_sb->s_blocksize_bits))

				i = (elen >> dir->i_sb->s_blocksize_bits) - offset;

		if (!(offset & ((16 >> (sb->s_blocksize_bits - 9)) - 1))) {

			i = 16 >> (sb->s_blocksize_bits - 9);

			if (i + offset > (elen >> sb->s_blocksize_bits))

				i = (elen >> sb->s_blocksize_bits) - offset;

			for (num = 0; i > 0; i--) {

				block = udf_get_lb_pblock(dir->i_sb, &eloc, offset + i);

				tmp = udf_tgetblk(dir->i_sb, block);

				block = udf_get_lb_pblock(sb, &eloc, offset + i);

				tmp = udf_tgetblk(sb, block);

				if (tmp && !buffer_uptodate(tmp) && !buffer_locked(tmp))

					bha[num++] = tmp;

				else
@@ -152,12 +153,12 @@ static int udf_readdir(struct file *file, struct dir_context *ctx) 
		}



		if ((cfi.fileCharacteristics & FID_FILE_CHAR_DELETED) != 0) {

			if (!UDF_QUERY_FLAG(dir->i_sb, UDF_FLAG_UNDELETE))

			if (!UDF_QUERY_FLAG(sb, UDF_FLAG_UNDELETE))

				continue;

		}



		if ((cfi.fileCharacteristics & FID_FILE_CHAR_HIDDEN) != 0) {

			if (!UDF_QUERY_FLAG(dir->i_sb, UDF_FLAG_UNHIDE))

			if (!UDF_QUERY_FLAG(sb, UDF_FLAG_UNHIDE))

				continue;

		}
@@ -167,12 +168,12 @@ static int udf_readdir(struct file *file, struct dir_context *ctx) 
			continue;

		}



		flen = udf_get_filename(dir->i_sb, nameptr, fname, lfi);

		flen = udf_get_filename(sb, nameptr, lfi, fname, UDF_NAME_LEN);

		if (!flen)

			continue;



		tloc = lelb_to_cpu(cfi.icb.extLocation);

		iblock = udf_get_lb_pblock(dir->i_sb, &tloc, 0);

		iblock = udf_get_lb_pblock(sb, &tloc, 0);

		if (!dir_emit(ctx, fname, flen, iblock, DT_UNKNOWN))

			goto out;

	} /* end while */

fs/udf/inode.c

+14 −0
Original line number Diff line number Diff line
@@ -1489,6 +1489,20 @@ static int udf_read_inode(struct inode *inode, bool hidden_inode) 
	}

	inode->i_generation = iinfo->i_unique;



	/* Sanity checks for files in ICB so that we don't get confused later */

	if (iinfo->i_alloc_type == ICBTAG_FLAG_AD_IN_ICB) {

		/*

		 * For file in ICB data is stored in allocation descriptor

		 * so sizes should match

		 */

		if (iinfo->i_lenAlloc != inode->i_size)

			goto out;

		/* File in ICB has to fit in there... */

		if (inode->i_size > inode->i_sb->s_blocksize -

					udf_file_entry_alloc_offset(inode))

			goto out;

	}



	switch (fe->icbTag.fileType) {

	case ICBTAG_FILE_TYPE_DIRECTORY:

		inode->i_op = &udf_dir_inode_operations;

fs/udf/namei.c

+9 −8
Original line number Diff line number Diff line
@@ -159,18 +159,19 @@ static struct fileIdentDesc *udf_find_entry(struct inode *dir, 
	struct udf_inode_info *dinfo = UDF_I(dir);

	int isdotdot = child->len == 2 &&

		child->name[0] == '.' && child->name[1] == '.';

	struct super_block *sb = dir->i_sb;



	size = udf_ext0_offset(dir) + dir->i_size;

	f_pos = udf_ext0_offset(dir);



	fibh->sbh = fibh->ebh = NULL;

	fibh->soffset = fibh->eoffset = f_pos & (dir->i_sb->s_blocksize - 1);

	fibh->soffset = fibh->eoffset = f_pos & (sb->s_blocksize - 1);

	if (dinfo->i_alloc_type != ICBTAG_FLAG_AD_IN_ICB) {

		if (inode_bmap(dir, f_pos >> dir->i_sb->s_blocksize_bits, &epos,

		if (inode_bmap(dir, f_pos >> sb->s_blocksize_bits, &epos,

		    &eloc, &elen, &offset) != (EXT_RECORDED_ALLOCATED >> 30))

			goto out_err;

		block = udf_get_lb_pblock(dir->i_sb, &eloc, offset);

		if ((++offset << dir->i_sb->s_blocksize_bits) < elen) {

		block = udf_get_lb_pblock(sb, &eloc, offset);

		if ((++offset << sb->s_blocksize_bits) < elen) {

			if (dinfo->i_alloc_type == ICBTAG_FLAG_AD_SHORT)

				epos.offset -= sizeof(struct short_ad);

			else if (dinfo->i_alloc_type == ICBTAG_FLAG_AD_LONG)
@@ -178,7 +179,7 @@ static struct fileIdentDesc *udf_find_entry(struct inode *dir, 
		} else

			offset = 0;



		fibh->sbh = fibh->ebh = udf_tread(dir->i_sb, block);

		fibh->sbh = fibh->ebh = udf_tread(sb, block);

		if (!fibh->sbh)

			goto out_err;

	}
@@ -217,12 +218,12 @@ static struct fileIdentDesc *udf_find_entry(struct inode *dir, 
		}



		if ((cfi->fileCharacteristics & FID_FILE_CHAR_DELETED) != 0) {

			if (!UDF_QUERY_FLAG(dir->i_sb, UDF_FLAG_UNDELETE))

			if (!UDF_QUERY_FLAG(sb, UDF_FLAG_UNDELETE))

				continue;

		}



		if ((cfi->fileCharacteristics & FID_FILE_CHAR_HIDDEN) != 0) {

			if (!UDF_QUERY_FLAG(dir->i_sb, UDF_FLAG_UNHIDE))

			if (!UDF_QUERY_FLAG(sb, UDF_FLAG_UNHIDE))

				continue;

		}
@@ -233,7 +234,7 @@ static struct fileIdentDesc *udf_find_entry(struct inode *dir, 
		if (!lfi)

			continue;



		flen = udf_get_filename(dir->i_sb, nameptr, fname, lfi);

		flen = udf_get_filename(sb, nameptr, lfi, fname, UDF_NAME_LEN);

		if (flen && udf_match(flen, fname, child->len, child->name))

			goto out_ok;

	}

fs/udf/symlink.c

+46 −11
Original line number Diff line number Diff line
@@ -30,49 +30,73 @@ 
#include <linux/buffer_head.h>

#include "udf_i.h"



static void udf_pc_to_char(struct super_block *sb, unsigned char *from,

			   int fromlen, unsigned char *to)

static int udf_pc_to_char(struct super_block *sb, unsigned char *from,

			  int fromlen, unsigned char *to, int tolen)

{

	struct pathComponent *pc;

	int elen = 0;

	int comp_len;

	unsigned char *p = to;



	/* Reserve one byte for terminating \0 */

	tolen--;

	while (elen < fromlen) {

		pc = (struct pathComponent *)(from + elen);

		elen += sizeof(struct pathComponent);

		switch (pc->componentType) {

		case 1:

			/*

			 * Symlink points to some place which should be agreed

 			 * upon between originator and receiver of the media. Ignore.

			 */

			if (pc->lengthComponentIdent > 0)

			if (pc->lengthComponentIdent > 0) {

				elen += pc->lengthComponentIdent;

				break;

			}

			/* Fall through */

		case 2:

			if (tolen == 0)

				return -ENAMETOOLONG;

			p = to;

			*p++ = '/';

			tolen--;

			break;

		case 3:

			if (tolen < 3)

				return -ENAMETOOLONG;

			memcpy(p, "../", 3);

			p += 3;

			tolen -= 3;

			break;

		case 4:

			if (tolen < 2)

				return -ENAMETOOLONG;

			memcpy(p, "./", 2);

			p += 2;

			tolen -= 2;

			/* that would be . - just ignore */

			break;

		case 5:

			p += udf_get_filename(sb, pc->componentIdent, p,

					      pc->lengthComponentIdent);

			elen += pc->lengthComponentIdent;

			if (elen > fromlen)

				return -EIO;

			comp_len = udf_get_filename(sb, pc->componentIdent,

						    pc->lengthComponentIdent,

						    p, tolen);

			p += comp_len;

			tolen -= comp_len;

			if (tolen == 0)

				return -ENAMETOOLONG;

			*p++ = '/';

			tolen--;

			break;

		}

		elen += sizeof(struct pathComponent) + pc->lengthComponentIdent;

	}

	if (p > to + 1)

		p[-1] = '\0';

	else

		p[0] = '\0';

	return 0;

}



static int udf_symlink_filler(struct file *file, struct page *page)
@@ -80,11 +104,17 @@ static int udf_symlink_filler(struct file *file, struct page *page) 
	struct inode *inode = page->mapping->host;

	struct buffer_head *bh = NULL;

	unsigned char *symlink;

	int err = -EIO;

	int err;

	unsigned char *p = kmap(page);

	struct udf_inode_info *iinfo;

	uint32_t pos;



	/* We don't support symlinks longer than one block */

	if (inode->i_size > inode->i_sb->s_blocksize) {

		err = -ENAMETOOLONG;

		goto out_unmap;

	}



	iinfo = UDF_I(inode);

	pos = udf_block_map(inode, 0);
@@ -94,14 +124,18 @@ static int udf_symlink_filler(struct file *file, struct page *page) 
	} else {

		bh = sb_bread(inode->i_sb, pos);



		if (!bh)

			goto out;

		if (!bh) {

			err = -EIO;

			goto out_unlock_inode;

		}



		symlink = bh->b_data;

	}



	udf_pc_to_char(inode->i_sb, symlink, inode->i_size, p);

	err = udf_pc_to_char(inode->i_sb, symlink, inode->i_size, p, PAGE_SIZE);

	brelse(bh);

	if (err)

		goto out_unlock_inode;



	up_read(&iinfo->i_data_sem);

	SetPageUptodate(page);
@@ -109,9 +143,10 @@ static int udf_symlink_filler(struct file *file, struct page *page) 
	unlock_page(page);

	return 0;



out:

out_unlock_inode:

	up_read(&iinfo->i_data_sem);

	SetPageError(page);

out_unmap:

	kunmap(page);

	unlock_page(page);

	return err;