Commit a4eb9356 authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge tag 'fs_for_v6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs 

Pull udf and quota updates from Jan Kara:
 "A fix for UDF and quota"

* tag 'fs_for_v6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs:
  fs: udf: fix OOB read in lengthAllocDescs handling
  fs: quota: create dedicated workqueue for quota_release_work
parents 67f5f11c 3bd5e45c

fs/quota/dquot.c

+9 −1
Original line number Diff line number Diff line
@@ -162,6 +162,9 @@ static struct quota_module_name module_names[] = INIT_QUOTA_MODULE_NAMES; 
/* SLAB cache for dquot structures */

static struct kmem_cache *dquot_cachep;



/* workqueue for work quota_release_work*/

static struct workqueue_struct *quota_unbound_wq;



void register_quota_format(struct quota_format_type *fmt)

{

	spin_lock(&dq_list_lock);
@@ -881,7 +884,7 @@ void dqput(struct dquot *dquot) 
	put_releasing_dquots(dquot);

	atomic_dec(&dquot->dq_count);

	spin_unlock(&dq_list_lock);

	queue_delayed_work(system_dfl_wq, &quota_release_work, 1);

	queue_delayed_work(quota_unbound_wq, &quota_release_work, 1);

}

EXPORT_SYMBOL(dqput);
@@ -3041,6 +3044,11 @@ static int __init dquot_init(void) 


	shrinker_register(dqcache_shrinker);



	quota_unbound_wq = alloc_workqueue("quota_events_unbound",

					   WQ_UNBOUND | WQ_MEM_RECLAIM, WQ_MAX_ACTIVE);

	if (!quota_unbound_wq)

		panic("Cannot create quota_unbound_wq\n");



	return 0;

}

fs_initcall(dquot_init);

fs/udf/inode.c

+3 −0
Original line number Diff line number Diff line
@@ -2272,6 +2272,9 @@ int udf_current_aext(struct inode *inode, struct extent_position *epos, 
		if (check_add_overflow(sizeof(struct allocExtDesc),

				le32_to_cpu(header->lengthAllocDescs), &alen))

			return -1;



		if (alen > epos->bh->b_size)

			return -1;

	}



	switch (iinfo->i_alloc_type) {