Jan Kara 09ebb17ab4 udf: Fix data corruption on file type conversion ... UDF has two types of files - files with data stored in inode (ICB in UDF terminology) and files with data stored in external data blocks. We convert file from in-inode format to external format in udf_file_aio_write() when we find out data won't fit into inode any longer. However the following race between two O_APPEND writes can happen: CPU1 CPU2 udf_file_aio_write() udf_file_aio_write() down_write(&iinfo->i_data_sem); checks that i_size + count1 fits within inode => no need to convert up_write(&iinfo->i_data_sem); down_write(&iinfo->i_data_sem); checks that i_size + count2 fits within inode => no need to convert up_write(&iinfo->i_data_sem); generic_file_aio_write() - extends file by count1 bytes generic_file_aio_write() - extends file by count2 bytes Clearly if count1 + count2 doesn't fit into the inode, we overwrite kernel buffers beyond inode, possibly corrupting the filesystem as well. Fix the problem by acquiring i_mutex before checking whether write fits into the inode and using __generic_file_aio_write() afterwards which puts check and write into one critical section. Reported-by: Al Viro <viro@ZenIV.linux.org.uk> Signed-off-by: Jan Kara <jack@suse.cz>		2014-02-20 21:56:00 +01:00
..
balloc.c
dir.c
directory.c
ecma_167.h
file.c	udf: Fix data corruption on file type conversion	2014-02-20 21:56:00 +01:00
ialloc.c	udf: Fortify LVID loading	2013-09-24 11:23:33 +02:00
inode.c	udf: Fix data corruption on file type conversion	2014-02-20 21:56:00 +01:00
Kconfig
lowlevel.c
Makefile
misc.c
namei.c	udf: Fix lockdep warning from udf_symlink()	2013-12-23 22:02:16 +01:00
osta_udf.h
partition.c
super.c	udf: fix for pathetic mount times in case of invalid file system	2013-10-18 22:39:07 +02:00
symlink.c
truncate.c
udf_i.h
udf_sb.h	udf: Fortify LVID loading	2013-09-24 11:23:33 +02:00
udfdecl.h
udfend.h
udftime.c
unicode.c