mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-08-26 10:49:33 +00:00
Merge branch 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs
Pull UDF & isofs fixes from Jan Kara: "A couple of UDF fixes of handling of corrupted media and one iso9660 fix of the same" * 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs: udf: Reduce repeated dereferences udf: Check component length before reading it udf: Check path length when reading symlink udf: Verify symlink size before loading it udf: Verify i_size when loading inode isofs: Fix unchecked printing of ER records
This commit is contained in:
commit
b9d4a35f0a
7 changed files with 106 additions and 47 deletions
|
@ -362,6 +362,9 @@ parse_rock_ridge_inode_internal(struct iso_directory_record *de,
|
|||
rs.cont_size = isonum_733(rr->u.CE.size);
|
||||
break;
|
||||
case SIG('E', 'R'):
|
||||
/* Invalid length of ER tag id? */
|
||||
if (rr->u.ER.len_id + offsetof(struct rock_ridge, u.ER.data) > rr->len)
|
||||
goto out;
|
||||
ISOFS_SB(inode->i_sb)->s_rock = 1;
|
||||
printk(KERN_DEBUG "ISO 9660 Extensions: ");
|
||||
{
|
||||
|
|
31
fs/udf/dir.c
31
fs/udf/dir.c
|
@ -57,6 +57,7 @@ static int udf_readdir(struct file *file, struct dir_context *ctx)
|
|||
sector_t offset;
|
||||
int i, num, ret = 0;
|
||||
struct extent_position epos = { NULL, 0, {0, 0} };
|
||||
struct super_block *sb = dir->i_sb;
|
||||
|
||||
if (ctx->pos == 0) {
|
||||
if (!dir_emit_dot(file, ctx))
|
||||
|
@ -76,16 +77,16 @@ static int udf_readdir(struct file *file, struct dir_context *ctx)
|
|||
if (nf_pos == 0)
|
||||
nf_pos = udf_ext0_offset(dir);
|
||||
|
||||
fibh.soffset = fibh.eoffset = nf_pos & (dir->i_sb->s_blocksize - 1);
|
||||
fibh.soffset = fibh.eoffset = nf_pos & (sb->s_blocksize - 1);
|
||||
if (iinfo->i_alloc_type != ICBTAG_FLAG_AD_IN_ICB) {
|
||||
if (inode_bmap(dir, nf_pos >> dir->i_sb->s_blocksize_bits,
|
||||
if (inode_bmap(dir, nf_pos >> sb->s_blocksize_bits,
|
||||
&epos, &eloc, &elen, &offset)
|
||||
!= (EXT_RECORDED_ALLOCATED >> 30)) {
|
||||
ret = -ENOENT;
|
||||
goto out;
|
||||
}
|
||||
block = udf_get_lb_pblock(dir->i_sb, &eloc, offset);
|
||||
if ((++offset << dir->i_sb->s_blocksize_bits) < elen) {
|
||||
block = udf_get_lb_pblock(sb, &eloc, offset);
|
||||
if ((++offset << sb->s_blocksize_bits) < elen) {
|
||||
if (iinfo->i_alloc_type == ICBTAG_FLAG_AD_SHORT)
|
||||
epos.offset -= sizeof(struct short_ad);
|
||||
else if (iinfo->i_alloc_type ==
|
||||
|
@ -95,18 +96,18 @@ static int udf_readdir(struct file *file, struct dir_context *ctx)
|
|||
offset = 0;
|
||||
}
|
||||
|
||||
if (!(fibh.sbh = fibh.ebh = udf_tread(dir->i_sb, block))) {
|
||||
if (!(fibh.sbh = fibh.ebh = udf_tread(sb, block))) {
|
||||
ret = -EIO;
|
||||
goto out;
|
||||
}
|
||||
|
||||
if (!(offset & ((16 >> (dir->i_sb->s_blocksize_bits - 9)) - 1))) {
|
||||
i = 16 >> (dir->i_sb->s_blocksize_bits - 9);
|
||||
if (i + offset > (elen >> dir->i_sb->s_blocksize_bits))
|
||||
i = (elen >> dir->i_sb->s_blocksize_bits) - offset;
|
||||
if (!(offset & ((16 >> (sb->s_blocksize_bits - 9)) - 1))) {
|
||||
i = 16 >> (sb->s_blocksize_bits - 9);
|
||||
if (i + offset > (elen >> sb->s_blocksize_bits))
|
||||
i = (elen >> sb->s_blocksize_bits) - offset;
|
||||
for (num = 0; i > 0; i--) {
|
||||
block = udf_get_lb_pblock(dir->i_sb, &eloc, offset + i);
|
||||
tmp = udf_tgetblk(dir->i_sb, block);
|
||||
block = udf_get_lb_pblock(sb, &eloc, offset + i);
|
||||
tmp = udf_tgetblk(sb, block);
|
||||
if (tmp && !buffer_uptodate(tmp) && !buffer_locked(tmp))
|
||||
bha[num++] = tmp;
|
||||
else
|
||||
|
@ -152,12 +153,12 @@ static int udf_readdir(struct file *file, struct dir_context *ctx)
|
|||
}
|
||||
|
||||
if ((cfi.fileCharacteristics & FID_FILE_CHAR_DELETED) != 0) {
|
||||
if (!UDF_QUERY_FLAG(dir->i_sb, UDF_FLAG_UNDELETE))
|
||||
if (!UDF_QUERY_FLAG(sb, UDF_FLAG_UNDELETE))
|
||||
continue;
|
||||
}
|
||||
|
||||
if ((cfi.fileCharacteristics & FID_FILE_CHAR_HIDDEN) != 0) {
|
||||
if (!UDF_QUERY_FLAG(dir->i_sb, UDF_FLAG_UNHIDE))
|
||||
if (!UDF_QUERY_FLAG(sb, UDF_FLAG_UNHIDE))
|
||||
continue;
|
||||
}
|
||||
|
||||
|
@ -167,12 +168,12 @@ static int udf_readdir(struct file *file, struct dir_context *ctx)
|
|||
continue;
|
||||
}
|
||||
|
||||
flen = udf_get_filename(dir->i_sb, nameptr, fname, lfi);
|
||||
flen = udf_get_filename(sb, nameptr, lfi, fname, UDF_NAME_LEN);
|
||||
if (!flen)
|
||||
continue;
|
||||
|
||||
tloc = lelb_to_cpu(cfi.icb.extLocation);
|
||||
iblock = udf_get_lb_pblock(dir->i_sb, &tloc, 0);
|
||||
iblock = udf_get_lb_pblock(sb, &tloc, 0);
|
||||
if (!dir_emit(ctx, fname, flen, iblock, DT_UNKNOWN))
|
||||
goto out;
|
||||
} /* end while */
|
||||
|
|
|
@ -1489,6 +1489,20 @@ static int udf_read_inode(struct inode *inode, bool hidden_inode)
|
|||
}
|
||||
inode->i_generation = iinfo->i_unique;
|
||||
|
||||
/* Sanity checks for files in ICB so that we don't get confused later */
|
||||
if (iinfo->i_alloc_type == ICBTAG_FLAG_AD_IN_ICB) {
|
||||
/*
|
||||
* For file in ICB data is stored in allocation descriptor
|
||||
* so sizes should match
|
||||
*/
|
||||
if (iinfo->i_lenAlloc != inode->i_size)
|
||||
goto out;
|
||||
/* File in ICB has to fit in there... */
|
||||
if (inode->i_size > inode->i_sb->s_blocksize -
|
||||
udf_file_entry_alloc_offset(inode))
|
||||
goto out;
|
||||
}
|
||||
|
||||
switch (fe->icbTag.fileType) {
|
||||
case ICBTAG_FILE_TYPE_DIRECTORY:
|
||||
inode->i_op = &udf_dir_inode_operations;
|
||||
|
|
|
@ -159,18 +159,19 @@ static struct fileIdentDesc *udf_find_entry(struct inode *dir,
|
|||
struct udf_inode_info *dinfo = UDF_I(dir);
|
||||
int isdotdot = child->len == 2 &&
|
||||
child->name[0] == '.' && child->name[1] == '.';
|
||||
struct super_block *sb = dir->i_sb;
|
||||
|
||||
size = udf_ext0_offset(dir) + dir->i_size;
|
||||
f_pos = udf_ext0_offset(dir);
|
||||
|
||||
fibh->sbh = fibh->ebh = NULL;
|
||||
fibh->soffset = fibh->eoffset = f_pos & (dir->i_sb->s_blocksize - 1);
|
||||
fibh->soffset = fibh->eoffset = f_pos & (sb->s_blocksize - 1);
|
||||
if (dinfo->i_alloc_type != ICBTAG_FLAG_AD_IN_ICB) {
|
||||
if (inode_bmap(dir, f_pos >> dir->i_sb->s_blocksize_bits, &epos,
|
||||
if (inode_bmap(dir, f_pos >> sb->s_blocksize_bits, &epos,
|
||||
&eloc, &elen, &offset) != (EXT_RECORDED_ALLOCATED >> 30))
|
||||
goto out_err;
|
||||
block = udf_get_lb_pblock(dir->i_sb, &eloc, offset);
|
||||
if ((++offset << dir->i_sb->s_blocksize_bits) < elen) {
|
||||
block = udf_get_lb_pblock(sb, &eloc, offset);
|
||||
if ((++offset << sb->s_blocksize_bits) < elen) {
|
||||
if (dinfo->i_alloc_type == ICBTAG_FLAG_AD_SHORT)
|
||||
epos.offset -= sizeof(struct short_ad);
|
||||
else if (dinfo->i_alloc_type == ICBTAG_FLAG_AD_LONG)
|
||||
|
@ -178,7 +179,7 @@ static struct fileIdentDesc *udf_find_entry(struct inode *dir,
|
|||
} else
|
||||
offset = 0;
|
||||
|
||||
fibh->sbh = fibh->ebh = udf_tread(dir->i_sb, block);
|
||||
fibh->sbh = fibh->ebh = udf_tread(sb, block);
|
||||
if (!fibh->sbh)
|
||||
goto out_err;
|
||||
}
|
||||
|
@ -217,12 +218,12 @@ static struct fileIdentDesc *udf_find_entry(struct inode *dir,
|
|||
}
|
||||
|
||||
if ((cfi->fileCharacteristics & FID_FILE_CHAR_DELETED) != 0) {
|
||||
if (!UDF_QUERY_FLAG(dir->i_sb, UDF_FLAG_UNDELETE))
|
||||
if (!UDF_QUERY_FLAG(sb, UDF_FLAG_UNDELETE))
|
||||
continue;
|
||||
}
|
||||
|
||||
if ((cfi->fileCharacteristics & FID_FILE_CHAR_HIDDEN) != 0) {
|
||||
if (!UDF_QUERY_FLAG(dir->i_sb, UDF_FLAG_UNHIDE))
|
||||
if (!UDF_QUERY_FLAG(sb, UDF_FLAG_UNHIDE))
|
||||
continue;
|
||||
}
|
||||
|
||||
|
@ -233,7 +234,7 @@ static struct fileIdentDesc *udf_find_entry(struct inode *dir,
|
|||
if (!lfi)
|
||||
continue;
|
||||
|
||||
flen = udf_get_filename(dir->i_sb, nameptr, fname, lfi);
|
||||
flen = udf_get_filename(sb, nameptr, lfi, fname, UDF_NAME_LEN);
|
||||
if (flen && udf_match(flen, fname, child->len, child->name))
|
||||
goto out_ok;
|
||||
}
|
||||
|
|
|
@ -30,49 +30,73 @@
|
|||
#include <linux/buffer_head.h>
|
||||
#include "udf_i.h"
|
||||
|
||||
static void udf_pc_to_char(struct super_block *sb, unsigned char *from,
|
||||
int fromlen, unsigned char *to)
|
||||
static int udf_pc_to_char(struct super_block *sb, unsigned char *from,
|
||||
int fromlen, unsigned char *to, int tolen)
|
||||
{
|
||||
struct pathComponent *pc;
|
||||
int elen = 0;
|
||||
int comp_len;
|
||||
unsigned char *p = to;
|
||||
|
||||
/* Reserve one byte for terminating \0 */
|
||||
tolen--;
|
||||
while (elen < fromlen) {
|
||||
pc = (struct pathComponent *)(from + elen);
|
||||
elen += sizeof(struct pathComponent);
|
||||
switch (pc->componentType) {
|
||||
case 1:
|
||||
/*
|
||||
* Symlink points to some place which should be agreed
|
||||
* upon between originator and receiver of the media. Ignore.
|
||||
*/
|
||||
if (pc->lengthComponentIdent > 0)
|
||||
if (pc->lengthComponentIdent > 0) {
|
||||
elen += pc->lengthComponentIdent;
|
||||
break;
|
||||
}
|
||||
/* Fall through */
|
||||
case 2:
|
||||
if (tolen == 0)
|
||||
return -ENAMETOOLONG;
|
||||
p = to;
|
||||
*p++ = '/';
|
||||
tolen--;
|
||||
break;
|
||||
case 3:
|
||||
if (tolen < 3)
|
||||
return -ENAMETOOLONG;
|
||||
memcpy(p, "../", 3);
|
||||
p += 3;
|
||||
tolen -= 3;
|
||||
break;
|
||||
case 4:
|
||||
if (tolen < 2)
|
||||
return -ENAMETOOLONG;
|
||||
memcpy(p, "./", 2);
|
||||
p += 2;
|
||||
tolen -= 2;
|
||||
/* that would be . - just ignore */
|
||||
break;
|
||||
case 5:
|
||||
p += udf_get_filename(sb, pc->componentIdent, p,
|
||||
pc->lengthComponentIdent);
|
||||
elen += pc->lengthComponentIdent;
|
||||
if (elen > fromlen)
|
||||
return -EIO;
|
||||
comp_len = udf_get_filename(sb, pc->componentIdent,
|
||||
pc->lengthComponentIdent,
|
||||
p, tolen);
|
||||
p += comp_len;
|
||||
tolen -= comp_len;
|
||||
if (tolen == 0)
|
||||
return -ENAMETOOLONG;
|
||||
*p++ = '/';
|
||||
tolen--;
|
||||
break;
|
||||
}
|
||||
elen += sizeof(struct pathComponent) + pc->lengthComponentIdent;
|
||||
}
|
||||
if (p > to + 1)
|
||||
p[-1] = '\0';
|
||||
else
|
||||
p[0] = '\0';
|
||||
return 0;
|
||||
}
|
||||
|
||||
static int udf_symlink_filler(struct file *file, struct page *page)
|
||||
|
@ -80,11 +104,17 @@ static int udf_symlink_filler(struct file *file, struct page *page)
|
|||
struct inode *inode = page->mapping->host;
|
||||
struct buffer_head *bh = NULL;
|
||||
unsigned char *symlink;
|
||||
int err = -EIO;
|
||||
int err;
|
||||
unsigned char *p = kmap(page);
|
||||
struct udf_inode_info *iinfo;
|
||||
uint32_t pos;
|
||||
|
||||
/* We don't support symlinks longer than one block */
|
||||
if (inode->i_size > inode->i_sb->s_blocksize) {
|
||||
err = -ENAMETOOLONG;
|
||||
goto out_unmap;
|
||||
}
|
||||
|
||||
iinfo = UDF_I(inode);
|
||||
pos = udf_block_map(inode, 0);
|
||||
|
||||
|
@ -94,14 +124,18 @@ static int udf_symlink_filler(struct file *file, struct page *page)
|
|||
} else {
|
||||
bh = sb_bread(inode->i_sb, pos);
|
||||
|
||||
if (!bh)
|
||||
goto out;
|
||||
if (!bh) {
|
||||
err = -EIO;
|
||||
goto out_unlock_inode;
|
||||
}
|
||||
|
||||
symlink = bh->b_data;
|
||||
}
|
||||
|
||||
udf_pc_to_char(inode->i_sb, symlink, inode->i_size, p);
|
||||
err = udf_pc_to_char(inode->i_sb, symlink, inode->i_size, p, PAGE_SIZE);
|
||||
brelse(bh);
|
||||
if (err)
|
||||
goto out_unlock_inode;
|
||||
|
||||
up_read(&iinfo->i_data_sem);
|
||||
SetPageUptodate(page);
|
||||
|
@ -109,9 +143,10 @@ static int udf_symlink_filler(struct file *file, struct page *page)
|
|||
unlock_page(page);
|
||||
return 0;
|
||||
|
||||
out:
|
||||
out_unlock_inode:
|
||||
up_read(&iinfo->i_data_sem);
|
||||
SetPageError(page);
|
||||
out_unmap:
|
||||
kunmap(page);
|
||||
unlock_page(page);
|
||||
return err;
|
||||
|
|
|
@ -211,7 +211,8 @@ udf_get_lb_pblock(struct super_block *sb, struct kernel_lb_addr *loc,
|
|||
}
|
||||
|
||||
/* unicode.c */
|
||||
extern int udf_get_filename(struct super_block *, uint8_t *, uint8_t *, int);
|
||||
extern int udf_get_filename(struct super_block *, uint8_t *, int, uint8_t *,
|
||||
int);
|
||||
extern int udf_put_filename(struct super_block *, const uint8_t *, uint8_t *,
|
||||
int);
|
||||
extern int udf_build_ustr(struct ustr *, dstring *, int);
|
||||
|
|
|
@ -28,7 +28,8 @@
|
|||
|
||||
#include "udf_sb.h"
|
||||
|
||||
static int udf_translate_to_linux(uint8_t *, uint8_t *, int, uint8_t *, int);
|
||||
static int udf_translate_to_linux(uint8_t *, int, uint8_t *, int, uint8_t *,
|
||||
int);
|
||||
|
||||
static int udf_char_to_ustr(struct ustr *dest, const uint8_t *src, int strlen)
|
||||
{
|
||||
|
@ -333,8 +334,8 @@ static int udf_NLStoCS0(struct nls_table *nls, dstring *ocu, struct ustr *uni,
|
|||
return u_len + 1;
|
||||
}
|
||||
|
||||
int udf_get_filename(struct super_block *sb, uint8_t *sname, uint8_t *dname,
|
||||
int flen)
|
||||
int udf_get_filename(struct super_block *sb, uint8_t *sname, int slen,
|
||||
uint8_t *dname, int dlen)
|
||||
{
|
||||
struct ustr *filename, *unifilename;
|
||||
int len = 0;
|
||||
|
@ -347,7 +348,7 @@ int udf_get_filename(struct super_block *sb, uint8_t *sname, uint8_t *dname,
|
|||
if (!unifilename)
|
||||
goto out1;
|
||||
|
||||
if (udf_build_ustr_exact(unifilename, sname, flen))
|
||||
if (udf_build_ustr_exact(unifilename, sname, slen))
|
||||
goto out2;
|
||||
|
||||
if (UDF_QUERY_FLAG(sb, UDF_FLAG_UTF8)) {
|
||||
|
@ -366,7 +367,8 @@ int udf_get_filename(struct super_block *sb, uint8_t *sname, uint8_t *dname,
|
|||
} else
|
||||
goto out2;
|
||||
|
||||
len = udf_translate_to_linux(dname, filename->u_name, filename->u_len,
|
||||
len = udf_translate_to_linux(dname, dlen,
|
||||
filename->u_name, filename->u_len,
|
||||
unifilename->u_name, unifilename->u_len);
|
||||
out2:
|
||||
kfree(unifilename);
|
||||
|
@ -403,10 +405,12 @@ int udf_put_filename(struct super_block *sb, const uint8_t *sname,
|
|||
#define EXT_MARK '.'
|
||||
#define CRC_MARK '#'
|
||||
#define EXT_SIZE 5
|
||||
/* Number of chars we need to store generated CRC to make filename unique */
|
||||
#define CRC_LEN 5
|
||||
|
||||
static int udf_translate_to_linux(uint8_t *newName, uint8_t *udfName,
|
||||
int udfLen, uint8_t *fidName,
|
||||
int fidNameLen)
|
||||
static int udf_translate_to_linux(uint8_t *newName, int newLen,
|
||||
uint8_t *udfName, int udfLen,
|
||||
uint8_t *fidName, int fidNameLen)
|
||||
{
|
||||
int index, newIndex = 0, needsCRC = 0;
|
||||
int extIndex = 0, newExtIndex = 0, hasExt = 0;
|
||||
|
@ -439,7 +443,7 @@ static int udf_translate_to_linux(uint8_t *newName, uint8_t *udfName,
|
|||
newExtIndex = newIndex;
|
||||
}
|
||||
}
|
||||
if (newIndex < 256)
|
||||
if (newIndex < newLen)
|
||||
newName[newIndex++] = curr;
|
||||
else
|
||||
needsCRC = 1;
|
||||
|
@ -467,13 +471,13 @@ static int udf_translate_to_linux(uint8_t *newName, uint8_t *udfName,
|
|||
}
|
||||
ext[localExtIndex++] = curr;
|
||||
}
|
||||
maxFilenameLen = 250 - localExtIndex;
|
||||
maxFilenameLen = newLen - CRC_LEN - localExtIndex;
|
||||
if (newIndex > maxFilenameLen)
|
||||
newIndex = maxFilenameLen;
|
||||
else
|
||||
newIndex = newExtIndex;
|
||||
} else if (newIndex > 250)
|
||||
newIndex = 250;
|
||||
} else if (newIndex > newLen - CRC_LEN)
|
||||
newIndex = newLen - CRC_LEN;
|
||||
newName[newIndex++] = CRC_MARK;
|
||||
valueCRC = crc_itu_t(0, fidName, fidNameLen);
|
||||
newName[newIndex++] = hex_asc_upper_hi(valueCRC >> 8);
|
||||
|
|
Loading…
Reference in a new issue