Commit 9af33b57 authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge tag 'fixes_for_v4.20-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs 

Pull ext2 and udf fixes from Jan Kara:
 "Three small ext2 and udf fixes"

* tag 'fixes_for_v4.20-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs:
  ext2: fix potential use after free
  ext2: initialize opts.s_mount_opt as zero before using it
  udf: Allow mounting volumes with incorrect identification strings
parents 60b54823 ecebf55d

fs/ext2/super.c

+1 −0
Original line number Diff line number Diff line
@@ -892,6 +892,7 @@ static int ext2_fill_super(struct super_block *sb, void *data, int silent) 
	if (sb->s_magic != EXT2_SUPER_MAGIC)

		goto cantfind_ext2;



	opts.s_mount_opt = 0;

	/* Set defaults before we parse the mount options */

	def_mount_opts = le32_to_cpu(es->s_default_mount_opts);

	if (def_mount_opts & EXT2_DEFM_DEBUG)

fs/ext2/xattr.c

+1 −1
Original line number Diff line number Diff line
@@ -612,9 +612,9 @@ skip_replace: 
	}



cleanup:

	brelse(bh);

	if (!(bh && header == HDR(bh)))

		kfree(header);

	brelse(bh);

	up_write(&EXT2_I(inode)->xattr_sem);



	return error;

fs/udf/super.c

+10 −6
Original line number Diff line number Diff line
@@ -827,16 +827,20 @@ static int udf_load_pvoldesc(struct super_block *sb, sector_t block) 




	ret = udf_dstrCS0toChar(sb, outstr, 31, pvoldesc->volIdent, 32);

	if (ret < 0)

		goto out_bh;



	if (ret < 0) {

		strcpy(UDF_SB(sb)->s_volume_ident, "InvalidName");

		pr_warn("incorrect volume identification, setting to "

			"'InvalidName'\n");

	} else {

		strncpy(UDF_SB(sb)->s_volume_ident, outstr, ret);

	}

	udf_debug("volIdent[] = '%s'\n", UDF_SB(sb)->s_volume_ident);



	ret = udf_dstrCS0toChar(sb, outstr, 127, pvoldesc->volSetIdent, 128);

	if (ret < 0)

	if (ret < 0) {

		ret = 0;

		goto out_bh;



	}

	outstr[ret] = 0;

	udf_debug("volSetIdent[] = '%s'\n", outstr);

fs/udf/unicode.c

+11 −3
Original line number Diff line number Diff line
@@ -351,6 +351,11 @@ try_again: 
	return u_len;

}



/*

 * Convert CS0 dstring to output charset. Warning: This function may truncate

 * input string if it is too long as it is used for informational strings only

 * and it is better to truncate the string than to refuse mounting a media.

 */

int udf_dstrCS0toChar(struct super_block *sb, uint8_t *utf_o, int o_len,

		      const uint8_t *ocu_i, int i_len)

{
@@ -359,9 +364,12 @@ int udf_dstrCS0toChar(struct super_block *sb, uint8_t *utf_o, int o_len, 
	if (i_len > 0) {

		s_len = ocu_i[i_len - 1];

		if (s_len >= i_len) {

			pr_err("incorrect dstring lengths (%d/%d)\n",

			       s_len, i_len);

			return -EINVAL;

			pr_warn("incorrect dstring lengths (%d/%d),"

				" truncating\n", s_len, i_len);

			s_len = i_len - 1;

			/* 2-byte encoding? Need to round properly... */

			if (ocu_i[0] == 16)

				s_len -= (s_len - 1) & 2;

		}

	}

CRA Git | Maintained and supported by SUSTech CRA and CCSE