Commit f5cc15da authored by Jan Kara's avatar Jan Kara Committed by Linus Torvalds

Fix possible NULL pointer dereference in udf_table_free_blocks()

Fix possible NULL pointer dereference when freeing blocks in case table of
free space is used.  Also fix handling of the case when we need to move
extent from one block to another one to make space for indirect extent.
BTW: Nobody seem to have ever used this code.
Signed-off-by: default avatarJan Kara <jack@suse.cz>
Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
parent bcec4477
...@@ -540,26 +540,24 @@ static void udf_table_free_blocks(struct super_block *sb, ...@@ -540,26 +540,24 @@ static void udf_table_free_blocks(struct super_block *sb,
if (epos.offset + adsize > sb->s_blocksize) { if (epos.offset + adsize > sb->s_blocksize) {
loffset = epos.offset; loffset = epos.offset;
aed->lengthAllocDescs = cpu_to_le32(adsize); aed->lengthAllocDescs = cpu_to_le32(adsize);
sptr = UDF_I_DATA(inode) + epos.offset - sptr = UDF_I_DATA(table) + epos.offset - adsize;
udf_file_entry_alloc_offset(inode) +
UDF_I_LENEATTR(inode) - adsize;
dptr = epos.bh->b_data + sizeof(struct allocExtDesc); dptr = epos.bh->b_data + sizeof(struct allocExtDesc);
memcpy(dptr, sptr, adsize); memcpy(dptr, sptr, adsize);
epos.offset = sizeof(struct allocExtDesc) + adsize; epos.offset = sizeof(struct allocExtDesc) + adsize;
} else { } else {
loffset = epos.offset + adsize; loffset = epos.offset + adsize;
aed->lengthAllocDescs = cpu_to_le32(0); aed->lengthAllocDescs = cpu_to_le32(0);
sptr = oepos.bh->b_data + epos.offset;
epos.offset = sizeof(struct allocExtDesc);
if (oepos.bh) { if (oepos.bh) {
sptr = oepos.bh->b_data + epos.offset;
aed = (struct allocExtDesc *)oepos.bh->b_data; aed = (struct allocExtDesc *)oepos.bh->b_data;
aed->lengthAllocDescs = aed->lengthAllocDescs =
cpu_to_le32(le32_to_cpu(aed->lengthAllocDescs) + adsize); cpu_to_le32(le32_to_cpu(aed->lengthAllocDescs) + adsize);
} else { } else {
sptr = UDF_I_DATA(table) + epos.offset;
UDF_I_LENALLOC(table) += adsize; UDF_I_LENALLOC(table) += adsize;
mark_inode_dirty(table); mark_inode_dirty(table);
} }
epos.offset = sizeof(struct allocExtDesc);
} }
if (UDF_SB_UDFREV(sb) >= 0x0200) if (UDF_SB_UDFREV(sb) >= 0x0200)
udf_new_tag(epos.bh->b_data, TAG_IDENT_AED, 3, 1, udf_new_tag(epos.bh->b_data, TAG_IDENT_AED, 3, 1,
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment