Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 647bd61a authored by Cyrill Gorcunov's avatar Cyrill Gorcunov Committed by Linus Torvalds
Browse files

UDF: check for allocated memory for inode data 



This patch adds checking for granted memory while filling up inode data to
prevent possible NULL pointer usage.  If there is not enough memory to fill
inode data we just mark it as "bad".  Also some whitespace cleanup.

Signed-off-by: default avatarCyrill Gorcunov <gorcunov@gmail.com>
Cc: Jan Kara <jack@ucw.cz>
Cc: Christoph Hellwig <hch@lst.de>
Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
parent 9c1729db

fs/udf/inode.c

+39 −12
Original line number Diff line number Diff line
@@ -49,6 +49,7 @@ MODULE_LICENSE("GPL"); 
static mode_t udf_convert_permissions(struct fileEntry *);

static int udf_update_inode(struct inode *, int);

static void udf_fill_inode(struct inode *, struct buffer_head *);

static int udf_alloc_i_data(struct inode *inode, size_t size);

static struct buffer_head *inode_getblk(struct inode *, sector_t, int *,

	long *, int *);

static int8_t udf_insert_aext(struct inode *, struct extent_position,
@@ -1156,14 +1157,22 @@ static void udf_fill_inode(struct inode *inode, struct buffer_head *bh) 
	{

		UDF_I_EFE(inode) = 1;

		UDF_I_USE(inode) = 0;

		UDF_I_DATA(inode) = kmalloc(inode->i_sb->s_blocksize - sizeof(struct extendedFileEntry), GFP_KERNEL);

		if (udf_alloc_i_data(inode, inode->i_sb->s_blocksize - sizeof(struct extendedFileEntry)))

		{

			make_bad_inode(inode);

			return;

		}

		memcpy(UDF_I_DATA(inode), bh->b_data + sizeof(struct extendedFileEntry), inode->i_sb->s_blocksize - sizeof(struct extendedFileEntry));

	}

	else if (le16_to_cpu(fe->descTag.tagIdent) == TAG_IDENT_FE)

	{

		UDF_I_EFE(inode) = 0;

		UDF_I_USE(inode) = 0;

		UDF_I_DATA(inode) = kmalloc(inode->i_sb->s_blocksize - sizeof(struct fileEntry), GFP_KERNEL);

		if (udf_alloc_i_data(inode, inode->i_sb->s_blocksize - sizeof(struct fileEntry)))

		{

			make_bad_inode(inode);

			return;

		}

		memcpy(UDF_I_DATA(inode), bh->b_data + sizeof(struct fileEntry), inode->i_sb->s_blocksize - sizeof(struct fileEntry));

	}

	else if (le16_to_cpu(fe->descTag.tagIdent) == TAG_IDENT_USE)
@@ -1173,7 +1182,11 @@ static void udf_fill_inode(struct inode *inode, struct buffer_head *bh) 
		UDF_I_LENALLOC(inode) =

			le32_to_cpu(

				((struct unallocSpaceEntry *)bh->b_data)->lengthAllocDescs);

		UDF_I_DATA(inode) = kmalloc(inode->i_sb->s_blocksize - sizeof(struct unallocSpaceEntry), GFP_KERNEL);

		if (udf_alloc_i_data(inode, inode->i_sb->s_blocksize - sizeof(struct unallocSpaceEntry)))

		{

			make_bad_inode(inode);

			return;

		}

		memcpy(UDF_I_DATA(inode), bh->b_data + sizeof(struct unallocSpaceEntry), inode->i_sb->s_blocksize - sizeof(struct unallocSpaceEntry));

		return;

	}
@@ -1374,6 +1387,20 @@ static void udf_fill_inode(struct inode *inode, struct buffer_head *bh) 
	}

}



static int udf_alloc_i_data(struct inode *inode, size_t size)

{

	UDF_I_DATA(inode) = kmalloc(size, GFP_KERNEL);



	if (!UDF_I_DATA(inode))

	{

		printk(KERN_ERR "udf:udf_alloc_i_data (ino %ld) no free memory\n",

		       inode->i_ino);

		return -ENOMEM;

	}



	return 0;

}



static mode_t

udf_convert_permissions(struct fileEntry *fe)

{