From: Greg Kroah-Hartman Date: Sun, 1 Mar 2015 04:26:30 +0000 (-0800) Subject: remove queue-3.19/udf-check-length-of-extended-attributes-and-allocation-descriptors... X-Git-Tag: v3.10.71~30 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=fa82df1e361aefad81b57e239ab4b38ef4e7216d;p=thirdparty%2Fkernel%2Fstable-queue.git remove queue-3.19/udf-check-length-of-extended-attributes-and-allocation-descriptors.patch --- diff --git a/queue-3.19/series b/queue-3.19/series index 5afa04f4864..0e09c25ca46 100644 --- a/queue-3.19/series +++ b/queue-3.19/series @@ -19,7 +19,6 @@ iwlwifi-mvm-validate-tid-and-sta_id-in-ba_notif.patch iwlwifi-mvm-fix-failure-path-when-power_update-fails-in-add_interface.patch iwlwifi-mvm-always-use-mac-color-zero.patch hid-i2c-hid-limit-reads-to-wmaxinputlength-bytes-for-input-events.patch -udf-check-length-of-extended-attributes-and-allocation-descriptors.patch pci-generate-uppercase-hex-for-modalias-var-in-uevent.patch pci-fix-infinite-loop-with-rom-image-of-size-0.patch asoc-rt5670-set-use_single_rw-flag-for-regmap.patch diff --git a/queue-3.19/udf-check-length-of-extended-attributes-and-allocation-descriptors.patch b/queue-3.19/udf-check-length-of-extended-attributes-and-allocation-descriptors.patch deleted file mode 100644 index 68793074789..00000000000 --- a/queue-3.19/udf-check-length-of-extended-attributes-and-allocation-descriptors.patch +++ /dev/null @@ -1,39 +0,0 @@ -From 23b133bdc452aa441fcb9b82cbf6dd05cfd342d0 Mon Sep 17 00:00:00 2001 -From: Jan Kara -Date: Wed, 7 Jan 2015 13:49:08 +0100 -Subject: udf: Check length of extended attributes and allocation descriptors - -From: Jan Kara - -commit 23b133bdc452aa441fcb9b82cbf6dd05cfd342d0 upstream. - -Check length of extended attributes and allocation descriptors when -loading inodes from disk. Otherwise corrupted filesystems could confuse -the code and make the kernel oops. - -Reported-by: Carl Henrik Lunde -Signed-off-by: Jan Kara -Signed-off-by: Greg Kroah-Hartman - ---- - fs/udf/inode.c | 9 +++++++++ - 1 file changed, 9 insertions(+) - ---- a/fs/udf/inode.c -+++ b/fs/udf/inode.c -@@ -1489,6 +1489,15 @@ reread: - } - inode->i_generation = iinfo->i_unique; - -+ /* -+ * Sanity check length of allocation descriptors and extended attrs to -+ * avoid integer overflows -+ */ -+ if (iinfo->i_lenEAttr > bs || iinfo->i_lenAlloc > bs) -+ goto out; -+ /* Now do exact checks */ -+ if (udf_file_entry_alloc_offset(inode) + iinfo->i_lenAlloc > bs) -+ goto out; - /* Sanity checks for files in ICB so that we don't get confused later */ - if (iinfo->i_alloc_type == ICBTAG_FLAG_AD_IN_ICB) { - /*