Skip to content

Commit

Permalink
udf: Fix memory corruption when fs mounted with noadinicb option
Browse files Browse the repository at this point in the history
When UDF filesystem is mounted with noadinicb mount option, it
happens that we extend an empty directory with a block. A code in
udf_add_entry() didn't count with this possibility and used
uninitialized data leading to memory and filesystem corruption.
Add a check whether file already has some extents before operating
on them.

Signed-off-by: Jan Kara <jack@suse.cz>
  • Loading branch information
Jan Kara authored and Jan Kara committed May 7, 2008
1 parent 221e583 commit 9afadc4
Showing 1 changed file with 3 additions and 2 deletions.
5 changes: 3 additions & 2 deletions fs/udf/namei.c
Original file line number Diff line number Diff line change
Expand Up @@ -315,7 +315,7 @@ static struct fileIdentDesc *udf_add_entry(struct inode *dir,
uint16_t liu;
int block;
kernel_lb_addr eloc;
uint32_t elen;
uint32_t elen = 0;
sector_t offset;
struct extent_position epos = {};
struct udf_inode_info *dinfo;
Expand Down Expand Up @@ -406,7 +406,8 @@ static struct fileIdentDesc *udf_add_entry(struct inode *dir,
}

add:
if (dinfo->i_alloc_type != ICBTAG_FLAG_AD_IN_ICB) {
/* Is there any extent whose size we need to round up? */
if (dinfo->i_alloc_type != ICBTAG_FLAG_AD_IN_ICB && elen) {
elen = (elen + sb->s_blocksize - 1) & ~(sb->s_blocksize - 1);
if (dinfo->i_alloc_type == ICBTAG_FLAG_AD_SHORT)
epos.offset -= sizeof(short_ad);
Expand Down

0 comments on commit 9afadc4

Please sign in to comment.