lkml.org 
[lkml]   [2022]   [May]   [13]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.17 03/12] udf: Avoid using stale lengthOfImpUse
    Date
    From: Jan Kara <jack@suse.cz>

    commit c1ad35dd0548ce947d97aaf92f7f2f9a202951cf upstream.

    udf_write_fi() uses lengthOfImpUse of the entry it is writing to.
    However this field has not yet been initialized so it either contains
    completely bogus value or value from last directory entry at that place.
    In either case this is wrong and can lead to filesystem corruption or
    kernel crashes.

    Reported-by: butt3rflyh4ck <butterflyhuangxx@gmail.com>
    CC: stable@vger.kernel.org
    Fixes: 979a6e28dd96 ("udf: Get rid of 0-length arrays in struct fileIdentDesc")
    Signed-off-by: Jan Kara <jack@suse.cz>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    ---
    fs/udf/namei.c | 8 ++++----
    1 file changed, 4 insertions(+), 4 deletions(-)

    --- a/fs/udf/namei.c
    +++ b/fs/udf/namei.c
    @@ -75,11 +75,11 @@ int udf_write_fi(struct inode *inode, st

    if (fileident) {
    if (adinicb || (offset + lfi < 0)) {
    - memcpy(udf_get_fi_ident(sfi), fileident, lfi);
    + memcpy(sfi->impUse + liu, fileident, lfi);
    } else if (offset >= 0) {
    memcpy(fibh->ebh->b_data + offset, fileident, lfi);
    } else {
    - memcpy(udf_get_fi_ident(sfi), fileident, -offset);
    + memcpy(sfi->impUse + liu, fileident, -offset);
    memcpy(fibh->ebh->b_data, fileident - offset,
    lfi + offset);
    }
    @@ -88,11 +88,11 @@ int udf_write_fi(struct inode *inode, st
    offset += lfi;

    if (adinicb || (offset + padlen < 0)) {
    - memset(udf_get_fi_ident(sfi) + lfi, 0x00, padlen);
    + memset(sfi->impUse + liu + lfi, 0x00, padlen);
    } else if (offset >= 0) {
    memset(fibh->ebh->b_data + offset, 0x00, padlen);
    } else {
    - memset(udf_get_fi_ident(sfi) + lfi, 0x00, -offset);
    + memset(sfi->impUse + liu + lfi, 0x00, -offset);
    memset(fibh->ebh->b_data, 0x00, padlen + offset);
    }


    \
     
     \ /
      Last update: 2022-05-13 16:39    [W:2.892 / U:0.028 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site