diff options
| author | Linus Torvalds <torvalds@linux-foundation.org> | 2025-10-03 13:44:05 -0700 |
|---|---|---|
| committer | Linus Torvalds <torvalds@linux-foundation.org> | 2025-10-03 13:44:05 -0700 |
| commit | a4eb9356480fa47618e597a43284c52ac6023f28 (patch) | |
| tree | 61f6c305287b6bb7b211b64ca039b23bcff19e79 | |
| parent | 67f5f11cdf5081af9b592d8ab24d054a0d681b2f (diff) | |
| parent | 3bd5e45c2ce30e239d596becd5db720f7eb83c99 (diff) | |
Merge tag 'fs_for_v6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs
Pull udf and quota updates from Jan Kara:
"A fix for UDF and quota"
* tag 'fs_for_v6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs:
fs: udf: fix OOB read in lengthAllocDescs handling
fs: quota: create dedicated workqueue for quota_release_work
| -rw-r--r-- | fs/quota/dquot.c | 10 | ||||
| -rw-r--r-- | fs/udf/inode.c | 3 |
2 files changed, 12 insertions, 1 deletions
diff --git a/fs/quota/dquot.c b/fs/quota/dquot.c index afa15a214538..6c4a6ee1fa2b 100644 --- a/fs/quota/dquot.c +++ b/fs/quota/dquot.c @@ -162,6 +162,9 @@ static struct quota_module_name module_names[] = INIT_QUOTA_MODULE_NAMES; /* SLAB cache for dquot structures */ static struct kmem_cache *dquot_cachep; +/* workqueue for work quota_release_work*/ +static struct workqueue_struct *quota_unbound_wq; + void register_quota_format(struct quota_format_type *fmt) { spin_lock(&dq_list_lock); @@ -881,7 +884,7 @@ void dqput(struct dquot *dquot) put_releasing_dquots(dquot); atomic_dec(&dquot->dq_count); spin_unlock(&dq_list_lock); - queue_delayed_work(system_dfl_wq, "a_release_work, 1); + queue_delayed_work(quota_unbound_wq, "a_release_work, 1); } EXPORT_SYMBOL(dqput); @@ -3041,6 +3044,11 @@ static int __init dquot_init(void) shrinker_register(dqcache_shrinker); + quota_unbound_wq = alloc_workqueue("quota_events_unbound", + WQ_UNBOUND | WQ_MEM_RECLAIM, WQ_MAX_ACTIVE); + if (!quota_unbound_wq) + panic("Cannot create quota_unbound_wq\n"); + return 0; } fs_initcall(dquot_init); diff --git a/fs/udf/inode.c b/fs/udf/inode.c index f24aa98e6869..a79d73f28aa7 100644 --- a/fs/udf/inode.c +++ b/fs/udf/inode.c @@ -2272,6 +2272,9 @@ int udf_current_aext(struct inode *inode, struct extent_position *epos, if (check_add_overflow(sizeof(struct allocExtDesc), le32_to_cpu(header->lengthAllocDescs), &alen)) return -1; + + if (alen > epos->bh->b_size) + return -1; } switch (iinfo->i_alloc_type) { |