3.14-stable patches

added patches:
	udf-avoid-infinite-loop-when-processing-indirect-icbs.patch

diff --git a/queue-3.14/series b/queue-3.14/series
index e69de29bb2d1d6434b8b29ae775ad8c2e48c5391..88b44efd92d71725a217465971b19f170f43f338 100644 (file)
--- a/queue-3.14/series
+++ b/queue-3.14/series
@@ -0,0 +1 @@
+udf-avoid-infinite-loop-when-processing-indirect-icbs.patch

diff --git a/queue-3.14/udf-avoid-infinite-loop-when-processing-indirect-icbs.patch b/queue-3.14/udf-avoid-infinite-loop-when-processing-indirect-icbs.patch
new file mode 100644 (file)
index 0000000..5e948c5
--- /dev/null
+++ b/queue-3.14/udf-avoid-infinite-loop-when-processing-indirect-icbs.patch
@@ -0,0 +1,91 @@
+From c03aa9f6e1f938618e6db2e23afef0574efeeb65 Mon Sep 17 00:00:00 2001
+From: Jan Kara <jack@suse.cz>
+Date: Thu, 4 Sep 2014 14:06:55 +0200
+Subject: udf: Avoid infinite loop when processing indirect ICBs
+
+From: Jan Kara <jack@suse.cz>
+
+commit c03aa9f6e1f938618e6db2e23afef0574efeeb65 upstream.
+
+We did not implement any bound on number of indirect ICBs we follow when
+loading inode. Thus corrupted medium could cause kernel to go into an
+infinite loop, possibly causing a stack overflow.
+
+Fix the possible stack overflow by removing recursion from
+__udf_read_inode() and limit number of indirect ICBs we follow to avoid
+infinite loops.
+
+Signed-off-by: Jan Kara <jack@suse.cz>
+Cc: Chuck Ebbert <cebbert.lkml@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/udf/inode.c |   35 +++++++++++++++++++++--------------
+ 1 file changed, 21 insertions(+), 14 deletions(-)
+
+--- a/fs/udf/inode.c
++++ b/fs/udf/inode.c
+@@ -1271,13 +1271,22 @@ update_time:
+       return 0;
+ }
+ 
++/*
++ * Maximum length of linked list formed by ICB hierarchy. The chosen number is
++ * arbitrary - just that we hopefully don't limit any real use of rewritten
++ * inode on write-once media but avoid looping for too long on corrupted media.
++ */
++#define UDF_MAX_ICB_NESTING 1024
++
+ static void __udf_read_inode(struct inode *inode)
+ {
+       struct buffer_head *bh = NULL;
+       struct fileEntry *fe;
+       uint16_t ident;
+       struct udf_inode_info *iinfo = UDF_I(inode);
++      unsigned int indirections = 0;
+ 
++reread:
+       /*
+        * Set defaults, but the inode is still incomplete!
+        * Note: get_new_inode() sets the following on a new inode:
+@@ -1314,28 +1323,26 @@ static void __udf_read_inode(struct inod
+               ibh = udf_read_ptagged(inode->i_sb, &iinfo->i_location, 1,
+                                       &ident);
+               if (ident == TAG_IDENT_IE && ibh) {
+-                      struct buffer_head *nbh = NULL;
+                       struct kernel_lb_addr loc;
+                       struct indirectEntry *ie;
+ 
+                       ie = (struct indirectEntry *)ibh->b_data;
+                       loc = lelb_to_cpu(ie->indirectICB.extLocation);
+ 
+-                      if (ie->indirectICB.extLength &&
+-                              (nbh = udf_read_ptagged(inode->i_sb, &loc, 0,
+-                                                      &ident))) {
+-                              if (ident == TAG_IDENT_FE ||
+-                                      ident == TAG_IDENT_EFE) {
+-                                      memcpy(&iinfo->i_location,
+-                                              &loc,
+-                                              sizeof(struct kernel_lb_addr));
+-                                      brelse(bh);
+-                                      brelse(ibh);
+-                                      brelse(nbh);
+-                                      __udf_read_inode(inode);
++                      if (ie->indirectICB.extLength) {
++                              brelse(bh);
++                              brelse(ibh);
++                              memcpy(&iinfo->i_location, &loc,
++                                     sizeof(struct kernel_lb_addr));
++                              if (++indirections > UDF_MAX_ICB_NESTING) {
++                                      udf_err(inode->i_sb,
++                                              "too many ICBs in ICB hierarchy"
++                                              " (max %d supported)\n",
++                                              UDF_MAX_ICB_NESTING);
++                                      make_bad_inode(inode);
+                                       return;
+                               }
+-                              brelse(nbh);
++                              goto reread;
+                       }
+               }
+               brelse(ibh);