udf: Fix memory corruption when fs mounted with noadinicb option
When UDF filesystem is mounted with noadinicb mount option, it happens that we extend an empty directory with a block. A code in udf_add_entry() didn't count with this possibility and used uninitialized data leading to memory and filesystem corruption. Add a check whether file already has some extents before operating on them. Signed-off-by: Jan Kara <jack@suse.cz>
This commit is contained in:
Родитель
221e583a73
Коммит
9afadc4b1f
|
@ -315,7 +315,7 @@ static struct fileIdentDesc *udf_add_entry(struct inode *dir,
|
|||
uint16_t liu;
|
||||
int block;
|
||||
kernel_lb_addr eloc;
|
||||
uint32_t elen;
|
||||
uint32_t elen = 0;
|
||||
sector_t offset;
|
||||
struct extent_position epos = {};
|
||||
struct udf_inode_info *dinfo;
|
||||
|
@ -406,7 +406,8 @@ static struct fileIdentDesc *udf_add_entry(struct inode *dir,
|
|||
}
|
||||
|
||||
add:
|
||||
if (dinfo->i_alloc_type != ICBTAG_FLAG_AD_IN_ICB) {
|
||||
/* Is there any extent whose size we need to round up? */
|
||||
if (dinfo->i_alloc_type != ICBTAG_FLAG_AD_IN_ICB && elen) {
|
||||
elen = (elen + sb->s_blocksize - 1) & ~(sb->s_blocksize - 1);
|
||||
if (dinfo->i_alloc_type == ICBTAG_FLAG_AD_SHORT)
|
||||
epos.offset -= sizeof(short_ad);
|
||||
|
|
Загрузка…
Ссылка в новой задаче