diff mbox series

[5.15,14/21] udf: Avoid using stale lengthOfImpUse

Message ID	20220513142230.289833050@linuxfoundation.org
State	New
Headers	show Return-Path: <stable-owner@kernel.org> From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>, stable@vger.kernel.org, butt3rflyh4ck <butterflyhuangxx@gmail.com>, Jan Kara <jack@suse.cz> Subject: [PATCH 5.15 14/21] udf: Avoid using stale lengthOfImpUse Date: Fri, 13 May 2022 16:23:56 +0200 Message-Id: <20220513142230.289833050@linuxfoundation.org> In-Reply-To: <20220513142229.874949670@linuxfoundation.org> References: <20220513142229.874949670@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Precedence: bulk
Series	None \| expand [5.15,02/21] x86: Prepare asm files for straight-line-speculation [5.15,03/21] x86: Prepare inline-asm for straight-line-speculation [5.15,04/21] objtool: Add straight-line-speculation validation [5.15,05/21] x86/alternative: Relax text_poke_bp() constraint [5.15,06/21] kbuild: move objtool_args back to scripts/Makefile.build [5.15,07/21] x86: Add straight-line-speculation mitigation [5.15,08/21] tools arch: Update arch/x86/lib/mem{cpy,set}_64.S copies used in perf bench mem memcpy [5.15,09/21] kvm/emulate: Fix SETcc emulation function offsets with SLS [5.15,10/21] crypto: x86/poly1305 - Fixup SLS [5.15,11/21] objtool: Fix SLS validation for kcov tail-call replacement [5.15,12/21] Bluetooth: Fix the creation of hdev->name [5.15,13/21] rfkill: uapi: fix RFKILL_IOCTL_MAX_SIZE ioctl request definition [5.15,14/21] udf: Avoid using stale lengthOfImpUse [5.15,15/21] mm: fix missing cache flush for all tail pages of compound page [5.15,16/21] mm: hugetlb: fix missing cache flush in copy_huge_page_from_user() [5.15,17/21] mm: shmem: fix missing cache flush in shmem_mfill_atomic_pte() [5.15,18/21] mm: userfaultfd: fix missing cache flush in mcopy_atomic_pte() and __mcopy_atomic() [5.15,19/21] mm/hwpoison: fix error page recovered but reported "not recovered" [5.15,20/21] mm/mlock: fix potential imbalanced rlimit ucounts adjustment [5.15,21/21] mm: fix invalid page pointer returned with FOLL_PIN gups

Commit Message

Greg KH May 13, 2022, 2:23 p.m. UTC

From: Jan Kara <jack@suse.cz>

commit c1ad35dd0548ce947d97aaf92f7f2f9a202951cf upstream.

udf_write_fi() uses lengthOfImpUse of the entry it is writing to.
However this field has not yet been initialized so it either contains
completely bogus value or value from last directory entry at that place.
In either case this is wrong and can lead to filesystem corruption or
kernel crashes.

Reported-by: butt3rflyh4ck <butterflyhuangxx@gmail.com>
CC: stable@vger.kernel.org
Fixes: 979a6e28dd96 ("udf: Get rid of 0-length arrays in struct fileIdentDesc")
Signed-off-by: Jan Kara <jack@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/udf/namei.c |    8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff mbox series

Patch

--- a/fs/udf/namei.c
+++ b/fs/udf/namei.c
@@ -75,11 +75,11 @@  int udf_write_fi(struct inode *inode, st
 
 	if (fileident) {
 		if (adinicb || (offset + lfi < 0)) {
-			memcpy(udf_get_fi_ident(sfi), fileident, lfi);
+			memcpy(sfi->impUse + liu, fileident, lfi);
 		} else if (offset >= 0) {
 			memcpy(fibh->ebh->b_data + offset, fileident, lfi);
 		} else {
-			memcpy(udf_get_fi_ident(sfi), fileident, -offset);
+			memcpy(sfi->impUse + liu, fileident, -offset);
 			memcpy(fibh->ebh->b_data, fileident - offset,
 				lfi + offset);
 		}
@@ -88,11 +88,11 @@  int udf_write_fi(struct inode *inode, st
 	offset += lfi;
 
 	if (adinicb || (offset + padlen < 0)) {
-		memset(udf_get_fi_ident(sfi) + lfi, 0x00, padlen);
+		memset(sfi->impUse + liu + lfi, 0x00, padlen);
 	} else if (offset >= 0) {
 		memset(fibh->ebh->b_data + offset, 0x00, padlen);
 	} else {
-		memset(udf_get_fi_ident(sfi) + lfi, 0x00, -offset);
+		memset(sfi->impUse + liu + lfi, 0x00, -offset);
 		memset(fibh->ebh->b_data, 0x00, padlen + offset);
 	}