Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 8754a3f7 authored by Jan Kara's avatar Jan Kara
Browse files

udf: Protect udf_file_aio_write from possible races 



Code doing conversion from INICB file to a normal file in udf_file_aio_write()
is not protected by any lock from other code modifying the inode. Use
i_alloc_sem for that.

Reported-by: default avatarAlessio Igor Bogani <abogani@texware.it>
Signed-off-by: default avatarJan Kara <jack@suse.cz>
parent 9db9f9e3

fs/udf/file.c

+3 −0
Original line number Original line Diff line number Diff line
@@ -113,6 +113,7 @@ static ssize_t udf_file_aio_write(struct kiocb *iocb, const struct iovec *iov, 
	size_t count = iocb->ki_left;

	size_t count = iocb->ki_left;

	struct udf_inode_info *iinfo = UDF_I(inode);

	struct udf_inode_info *iinfo = UDF_I(inode);





	down_write(&iinfo->i_data_sem);

	if (iinfo->i_alloc_type == ICBTAG_FLAG_AD_IN_ICB) {

	if (iinfo->i_alloc_type == ICBTAG_FLAG_AD_IN_ICB) {

		if (file->f_flags & O_APPEND)

		if (file->f_flags & O_APPEND)

			pos = inode->i_size;

			pos = inode->i_size;
@@ -125,6 +126,7 @@ static ssize_t udf_file_aio_write(struct kiocb *iocb, const struct iovec *iov, 
			udf_expand_file_adinicb(inode, pos + count, &err);

			udf_expand_file_adinicb(inode, pos + count, &err);

			if (iinfo->i_alloc_type == ICBTAG_FLAG_AD_IN_ICB) {

			if (iinfo->i_alloc_type == ICBTAG_FLAG_AD_IN_ICB) {

				udf_debug("udf_expand_adinicb: err=%d\n", err);

				udf_debug("udf_expand_adinicb: err=%d\n", err);

				up_write(&iinfo->i_data_sem);

				return err;

				return err;

			}

			}

		} else {

		} else {
@@ -134,6 +136,7 @@ static ssize_t udf_file_aio_write(struct kiocb *iocb, const struct iovec *iov, 
				iinfo->i_lenAlloc = inode->i_size;

				iinfo->i_lenAlloc = inode->i_size;

		}

		}

	}

	}

	up_write(&iinfo->i_data_sem);





	retval = generic_file_aio_write(iocb, iov, nr_segs, ppos);

	retval = generic_file_aio_write(iocb, iov, nr_segs, ppos);

	if (retval > 0)

	if (retval > 0)