kernel.git/fs/udf, branch linux-2.6.34.y

udf: fix retun value on error path in udf_load_logicalvol

2014-02-10T21:11:33Z

commit 68766a2edcd5cd744262a70a2f67a320ac944760 upstream. In case we detect a problem and bail out, we fail to set "ret" to a nonzero value, and udf_load_logicalvol will mistakenly report success. Signed-off-by: Nikola Pajkovsky Signed-off-by: Jan Kara Signed-off-by: Paul Gortmaker

udf: Fix data corruption for files in ICB

2014-02-10T21:11:32Z

commit 9c2fc0de1a6e638fe58c354a463f544f42a90a09 upstream. When a file is stored in ICB (inode), we overwrite part of the file, and the page containing file's data is not in page cache, we end up corrupting file's data by overwriting them with zeros. The problem is we use simple_write_begin() which simply zeroes parts of the page which are not written to. The problem has been introduced by be021ee4 (udf: convert to new aops). Fix the problem by providing a ->write_begin function which makes the page properly uptodate. Reported-by: Ian Abbott Signed-off-by: Jan Kara Signed-off-by: Paul Gortmaker

udf: Fix bitmap overflow on large filesystems with small block size

2014-02-10T21:11:32Z

commit 89b1f39eb4189de745fae554b0d614d87c8d5c63 upstream. For large UDF filesystems with 512-byte blocks the number of necessary bitmap blocks is larger than 2^16 so s_nr_groups in udf_bitmap overflows (the number will overflow for filesystems larger than 128 GB with 512-byte blocks). That results in ENOSPC errors despite the filesystem has plenty of free space. Fix the problem by changing s_nr_groups' type to 'int'. That is enough even for filesystems 2^32 blocks (UDF maximum) and 512-byte blocksize. Reported-and-tested-by: v10lator@myway.de Signed-off-by: Jan Kara Signed-off-by: Paul Gortmaker

udf: avoid info leak on export

2014-02-10T21:11:32Z

commit 0143fc5e9f6f5aad4764801015bc8d4b4a278200 upstream. For type 0x51 the udf.parent_partref member in struct fid gets copied uninitialized to userland. Fix this by initializing it to 0. Signed-off-by: Mathias Krause Signed-off-by: Jan Kara Signed-off-by: Paul Gortmaker

udf: fix memory leak while allocating blocks during write

2014-02-10T21:11:32Z

commit 2fb7d99d0de3fd8ae869f35ab682581d8455887a upstream. Need to brelse the buffer_head stored in cur_epos and next_epos. Signed-off-by: Namjae Jeon Signed-off-by: Ashish Sangwan Signed-off-by: Jan Kara Signed-off-by: Paul Gortmaker

udf: fix udf_error build warnings

2014-02-10T21:10:41Z

The v2.6.34.14 commit "d7542a6 udf: Avoid run away loop when partition table length is corrupted" introduced the following build warning due to a change in the number of args in udf_error/udf_err for v2.6.34.14: CC fs/udf/super.o fs/udf/super.c: In function 'udf_load_sparable_map': fs/udf/super.c:1259: warning: passing argument 3 of 'udf_error' makes pointer from integer without a cast fs/udf/super.c:1265: warning: passing argument 3 of 'udf_error' makes pointer from integer without a cast fs/udf/super.c: In function 'udf_load_logicalvol': fs/udf/super.c:1313: warning: passing argument 3 of 'udf_error' makes pointer from integer without a cast The above warnings are due to a missing __func__ argument in the above udf_error function calls. This is because of commit 8076c363da15e7 ("udf: Rename udf_error to udf_err") which removed the __func__ arg. Restore the missing __func__ argument to fix the build warnings. Signed-off-by: George G. Davis Signed-off-by: Paul Gortmaker

udf: Improve table length check to avoid possible overflow

2013-01-16T21:45:06Z

commit 57b9655d01ef057a523e810d29c37ac09b80eead upstream. When a partition table length is corrupted to be close to 1 << 32, the check for its length may overflow on 32-bit systems and we will think the length is valid. Later on the kernel can crash trying to read beyond end of buffer. Fix the check to avoid possible overflow. Reported-by: Ben Hutchings Signed-off-by: Jan Kara Signed-off-by: Paul Gortmaker

udf: Avoid run away loop when partition table length is corrupted

2013-01-16T21:45:05Z

commit adee11b2085bee90bd8f4f52123ffb07882d6256 upstream. Check provided length of partition table so that (possibly maliciously) corrupted partition table cannot cause accessing data beyond current buffer. Signed-off-by: Jan Kara [PG: in 2.6.34 udf_err() is called udf_error()] Signed-off-by: Paul Gortmaker

udf: Fortify loading of sparing table

2013-01-16T21:45:05Z

commit 1df2ae31c724e57be9d7ac00d78db8a5dabdd050 upstream. Add sanity checks when loading sparing table from disk to avoid accessing unallocated memory or writing to it. Signed-off-by: Jan Kara [PG: in 2.6.34 udf_err() is called udf_error()] Signed-off-by: Paul Gortmaker

udf: add speciffic ->setattr callback

2010-04-08T13:35:20Z

generic setattr not longer responsible for quota transfer. use udf_setattr for all udf's inodes. Signed-off-by: Dmitry Monakhov Signed-off-by: Jan Kara