linux-toradex.git/fs/udf, branch v3.4.73

udf: avoid info leak on export

2013-03-28T19:12:27+00:00

commit 0143fc5e9f6f5aad4764801015bc8d4b4a278200 upstream.

For type 0x51 the udf.parent_partref member in struct fid gets copied
uninitialized to userland. Fix this by initializing it to 0.

Signed-off-by: Mathias Krause 
Signed-off-by: Jan Kara 
Cc: Ben Hutchings 
Signed-off-by: Greg Kroah-Hartman

udf: Fix bitmap overflow on large filesystems with small block size

2013-03-28T19:12:27+00:00

commit 89b1f39eb4189de745fae554b0d614d87c8d5c63 upstream.

For large UDF filesystems with 512-byte blocks the number of necessary
bitmap blocks is larger than 2^16 so s_nr_groups in udf_bitmap overflows
(the number will overflow for filesystems larger than 128 GB with
512-byte blocks). That results in ENOSPC errors despite the filesystem
has plenty of free space.

Fix the problem by changing s_nr_groups' type to 'int'. That is enough
even for filesystems 2^32 blocks (UDF maximum) and 512-byte blocksize.

Reported-and-tested-by: v10lator@myway.de
Signed-off-by: Jan Kara 
Cc: Jim Trigg 
Signed-off-by: Greg Kroah-Hartman

udf: don't increment lenExtents while writing to a hole

2013-01-17T16:50:53+00:00

commit fb719c59bdb4fca86ee1fd1f42ab3735ca12b6b2 upstream.

Incrementing lenExtents even while writing to a hole is bad
for performance as calls to udf_discard_prealloc and
udf_truncate_tail_extent would not return from start if
isize != lenExtents

Signed-off-by: Namjae Jeon 
Signed-off-by: Ashish Sangwan 
Signed-off-by: Jan Kara 
Signed-off-by: Shuah Khan 
Signed-off-by: Greg Kroah-Hartman

udf: fix memory leak while allocating blocks during write

2013-01-17T16:50:53+00:00

commit 2fb7d99d0de3fd8ae869f35ab682581d8455887a upstream.

Need to brelse the buffer_head stored in cur_epos and next_epos.

Signed-off-by: Namjae Jeon 
Signed-off-by: Ashish Sangwan 
Signed-off-by: Jan Kara 
Signed-off-by: Shuah Khan 
Signed-off-by: Greg Kroah-Hartman

udf: fix retun value on error path in udf_load_logicalvol

2012-10-12T20:39:00+00:00

commit 68766a2edcd5cd744262a70a2f67a320ac944760 upstream.

In case we detect a problem and bail out, we fail to set "ret" to a
nonzero value, and udf_load_logicalvol will mistakenly report success.

Signed-off-by: Nikola Pajkovsky 
Signed-off-by: Jan Kara 
Cc: Herton Ronaldo Krzesinski 
Signed-off-by: Greg Kroah-Hartman

udf: Fix data corruption for files in ICB

2012-09-14T17:00:32+00:00

commit 9c2fc0de1a6e638fe58c354a463f544f42a90a09 upstream.

When a file is stored in ICB (inode), we overwrite part of the file, and
the page containing file's data is not in page cache, we end up corrupting
file's data by overwriting them with zeros. The problem is we use
simple_write_begin() which simply zeroes parts of the page which are not
written to. The problem has been introduced by be021ee4 (udf: convert to
new aops).

Fix the problem by providing a ->write_begin function which makes the page
properly uptodate.

Reported-by: Ian Abbott 
Signed-off-by: Jan Kara 
Signed-off-by: Greg Kroah-Hartman

udf: Improve table length check to avoid possible overflow

2012-08-09T15:31:36+00:00

commit 57b9655d01ef057a523e810d29c37ac09b80eead upstream.

When a partition table length is corrupted to be close to 1 << 32, the
check for its length may overflow on 32-bit systems and we will think
the length is valid. Later on the kernel can crash trying to read beyond
end of buffer. Fix the check to avoid possible overflow.

Reported-by: Ben Hutchings 
Signed-off-by: Jan Kara 
Signed-off-by: Greg Kroah-Hartman

udf: Fortify loading of sparing table

2012-07-16T16:03:51+00:00

commit 1df2ae31c724e57be9d7ac00d78db8a5dabdd050 upstream.

Add sanity checks when loading sparing table from disk to avoid accessing
unallocated memory or writing to it.

Signed-off-by: Jan Kara 
Signed-off-by: Greg Kroah-Hartman

udf: Avoid run away loop when partition table length is corrupted

2012-07-16T16:03:51+00:00

commit adee11b2085bee90bd8f4f52123ffb07882d6256 upstream.

Check provided length of partition table so that (possibly maliciously)
corrupted partition table cannot cause accessing data beyond current buffer.

Signed-off-by: Jan Kara 
Signed-off-by: Greg Kroah-Hartman

udf: Use 'ret' instead of abusing 'i' in udf_load_logicalvol()

2012-07-16T16:03:51+00:00

commit cb14d340ef1737c24125dd663eff77734a482d47 upstream.

Signed-off-by: Jan Kara 
Signed-off-by: Greg Kroah-Hartman