udf: Fix races with i_size changes during readpage (9795e0e8) · Commits · 戴 / test

__udf_adinicb_readpage() uses i_size several times. When truncate changes i_size while the function is running, it can observe several different values and thus e.g. expose uninitialized parts of page to userspace. Also use i_size_read() in the function since it does not hold inode_lock. Since i_size is guaranteed to be small, this cannot really cause any issues even on 32-bit archs but let's be careful. CC: stable@vger.kernel.org Fixes: Signed-off-by:

Jan Kara <jack@suse.cz>

fs/udf/file.c

+7 −2

Original line number	Diff line number	Diff line
		@@ -43,10 +43,15 @@ static void __udf_adinicb_readpage(struct page *page)
		struct inode *inode = page->mapping->host;
		char *kaddr;
		struct udf_inode_info *iinfo = UDF_I(inode);
		loff_t isize = i_size_read(inode);

		/*
		* We have to be careful here as truncate can change i_size under us.
		* So just sample it once and use the same value everywhere.
		*/
		kaddr = kmap_atomic(page);
		memcpy(kaddr, iinfo->i_ext.i_data + iinfo->i_lenEAttr, inode->i_size);
		memset(kaddr + inode->i_size, 0, PAGE_SIZE - inode->i_size);
		memcpy(kaddr, iinfo->i_ext.i_data + iinfo->i_lenEAttr, isize);
		memset(kaddr + isize, 0, PAGE_SIZE - isize);
		flush_dcache_page(page);
		SetPageUptodate(page);
		kunmap_atomic(kaddr);

Admin message