Techwizz/kernel-fxtec-pro1x
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Fix possible NULL pointer dereference in udf_table_free_blocks()

Browse source 
Fix possible NULL pointer dereference when freeing blocks in case table of
free space is used.  Also fix handling of the case when we need to move
extent from one block to another one to make space for indirect extent.
BTW: Nobody seem to have ever used this code.

Signed-off-by: Jan Kara <jack@suse.cz>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
This commit is contained in:
Jan Kara 2007-08-30 23:56:22 -07:00 committed by Linus Torvalds
parent bcec44770c
commit f5cc15dac5
1 changed files with 4 additions and 6 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

10
fs/udf/balloc.c
View file

@ -540,26 +540,24 @@ static void udf_table_free_blocks(struct super_block *sb,
if (epos.offset + adsize > sb->s_blocksize) { if (epos.offset + adsize > sb->s_blocksize) {
loffset = epos.offset; loffset = epos.offset;
aed->lengthAllocDescs = cpu_to_le32(adsize); aed->lengthAllocDescs = cpu_to_le32(adsize);
sptr = UDF_I_DATA(inode) + epos.offset - sptr = UDF_I_DATA(table) + epos.offset - adsize;
udf_file_entry_alloc_offset(inode) +
UDF_I_LENEATTR(inode) - adsize;
dptr = epos.bh->b_data + sizeof(struct allocExtDesc); dptr = epos.bh->b_data + sizeof(struct allocExtDesc);
memcpy(dptr, sptr, adsize); memcpy(dptr, sptr, adsize);
epos.offset = sizeof(struct allocExtDesc) + adsize; epos.offset = sizeof(struct allocExtDesc) + adsize;
} else { } else {
loffset = epos.offset + adsize; loffset = epos.offset + adsize;
aed->lengthAllocDescs = cpu_to_le32(0); aed->lengthAllocDescs = cpu_to_le32(0);
sptr = oepos.bh->b_data + epos.offset;
epos.offset = sizeof(struct allocExtDesc);
if (oepos.bh) { if (oepos.bh) {
sptr = oepos.bh->b_data + epos.offset;
aed = (struct allocExtDesc *)oepos.bh->b_data; aed = (struct allocExtDesc *)oepos.bh->b_data;
aed->lengthAllocDescs = aed->lengthAllocDescs =
cpu_to_le32(le32_to_cpu(aed->lengthAllocDescs) + adsize); cpu_to_le32(le32_to_cpu(aed->lengthAllocDescs) + adsize);
} else { } else {
sptr = UDF_I_DATA(table) + epos.offset;
UDF_I_LENALLOC(table) += adsize; UDF_I_LENALLOC(table) += adsize;
mark_inode_dirty(table); mark_inode_dirty(table);
} }
epos.offset = sizeof(struct allocExtDesc);
} }
if (UDF_SB_UDFREV(sb) >= 0x0200) if (UDF_SB_UDFREV(sb) >= 0x0200)
udf_new_tag(epos.bh->b_data, TAG_IDENT_AED, 3, 1, udf_new_tag(epos.bh->b_data, TAG_IDENT_AED, 3, 1,