6.1-stable patches

added patches:
	udf-fix-directory-iteration-for-longer-tail-extents.patch

diff --git a/queue-6.1/series b/queue-6.1/series
index 272e3db223d91b2b3918bf1d048fd3cfbf475996..03313fd47312beb167e41d8f25e3c872f725977b 100644 (file)
--- a/queue-6.1/series
+++ b/queue-6.1/series
@@ -74,3 +74,4 @@ udmabuf-also-check-for-f_seal_future_write.patch
 of-fix-error-path-in-of_parse_phandle_with_args_map.patch
 of-fix-refcount-leakage-for-of-node-returned-by-__of_get_dma_parent.patch
 ceph-validate-snapdirname-option-length-when-mounting.patch
+udf-fix-directory-iteration-for-longer-tail-extents.patch

diff --git a/queue-6.1/udf-fix-directory-iteration-for-longer-tail-extents.patch b/queue-6.1/udf-fix-directory-iteration-for-longer-tail-extents.patch
new file mode 100644 (file)
index 0000000..e1298a7
--- /dev/null
+++ b/queue-6.1/udf-fix-directory-iteration-for-longer-tail-extents.patch
@@ -0,0 +1,32 @@
+From 1ea1cd11c72d1405a6b98440a9d5ea82dfa07166 Mon Sep 17 00:00:00 2001
+From: Jan Kara <jack@suse.cz>
+Date: Wed, 25 Jan 2023 11:43:03 +0100
+Subject: udf: Fix directory iteration for longer tail extents
+
+From: Jan Kara <jack@suse.cz>
+
+commit 1ea1cd11c72d1405a6b98440a9d5ea82dfa07166 upstream.
+
+When directory's last extent has more that one block and its length is
+not multiple of a block side, the code wrongly decided to move to the
+next extent instead of processing the last partial block. This led to
+directory corruption. Fix the rounding issue.
+
+Signed-off-by: Jan Kara <jack@suse.cz>
+Cc: Shreenidhi Shedi <yesshedi@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/udf/directory.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/fs/udf/directory.c
++++ b/fs/udf/directory.c
+@@ -170,7 +170,7 @@ static struct buffer_head *udf_fiiter_br
+ static int udf_fiiter_advance_blk(struct udf_fileident_iter *iter)
+ {
+       iter->loffset++;
+-      if (iter->loffset < iter->elen >> iter->dir->i_blkbits)
++      if (iter->loffset < DIV_ROUND_UP(iter->elen, 1<<iter->dir->i_blkbits))
+               return 0;
+ 
+       iter->loffset = 0;