Jan Kara 7e7154ffc2 udf: Check component length before reading it ... commit e237ec37ec154564f8690c5bd1795339955eeef9 upstream. Check that length specified in a component of a symlink fits in the input buffer we are reading. Also properly ignore component length for component types that do not use it. Otherwise we read memory after end of buffer for corrupted udf image. Reported-by: Carl Henrik Lunde <chlunde@ping.uio.no> Signed-off-by: Jan Kara <jack@suse.cz> Signed-off-by: Zefan Li <lizefan@huawei.com>		2015-04-14 17:33:48 +08:00
..
9p	9p changes for the 3.4 merge window	2012-03-28 09:58:38 -07:00
adfs	switch open-coded instances of d_make_root() to new helper	2012-03-20 21:29:35 -04:00
affs	switch open-coded instances of d_make_root() to new helper	2012-03-20 21:29:35 -04:00
afs	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2012-03-21 13:36:41 -07:00
autofs4	autofs - remove autofs dentry mount check	2013-05-11 13:48:06 -07:00
befs	switch open-coded instances of d_make_root() to new helper	2012-03-20 21:29:35 -04:00
bfs	switch open-coded instances of d_make_root() to new helper	2012-03-20 21:29:35 -04:00
btrfs	Btrfs: fix fs corruption on transaction abort if device supports discard	2015-04-14 17:33:45 +08:00
cachefiles	fs: cachefiles: add support for large files in filesystem caching	2014-06-07 16:02:04 -07:00
ceph	introduce SIZE_MAX	2014-07-31 12:54:53 -07:00
cifs	CIFS: Fix wrong directory attributes after rename	2014-09-25 11:49:11 +08:00
coda	Remove all #inclusions of asm/system.h	2012-03-28 18:30:03 +01:00
configfs	configfs: fix race between dentry put and lookup	2013-11-29 10:50:37 -08:00
cramfs	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2012-03-21 13:36:41 -07:00
debugfs	debugfs: debugfs_remove_recursive() must not rely on list_empty(d_subdirs)	2013-08-14 22:57:07 -07:00
devpts	devpts: plug the memory leak in kill_sb	2013-12-04 10:50:14 -08:00
dlm	dlm fixes for 3.4	2012-04-23 18:22:42 -07:00
ecryptfs	eCryptfs: Remove buggy and unnecessary write in file name decode routine	2015-04-14 17:33:43 +08:00
efs	switch open-coded instances of d_make_root() to new helper	2012-03-20 21:29:35 -04:00
exofs	ore: Fix wrong math in allocation of per device BIO	2014-02-13 11:51:11 -08:00
exportfs
ext2	ext2: Fix fs corruption in ext2_get_xip_mem()	2014-09-25 11:49:19 +08:00
ext3	ext3: Don't check quota format when there are no quota files	2015-02-02 17:05:00 +08:00
ext4	ext4: bail out from make_indexed_dir() on first error	2015-02-02 17:05:09 +08:00
fat	fat: fix possible overflow for fat_clusters	2013-06-07 12:49:12 -07:00
freevxfs	switch open-coded instances of d_make_root() to new helper	2012-03-20 21:29:35 -04:00
fscache	fs/fscache/stats.c: fix memory leak	2013-05-07 19:51:55 -07:00
fuse	fuse: hotfix truncate_pagecache() issue	2014-03-11 16:10:04 -07:00
gfs2	GFS2: Fix incorrect invalidation for DIO/buffered I/O	2014-01-08 09:42:12 -08:00
hfs	switch open-coded instances of d_make_root() to new helper	2012-03-20 21:29:35 -04:00
hfsplus	hfsplus: fix potential overflow in hfsplus_file_truncate()	2013-04-25 21:19:54 -07:00
hostfs	Merge branch 'for-linus-3.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rw/uml	2012-03-27 18:29:53 -07:00
hpfs	hpfs: deadlock and race in directory lseek()	2014-02-13 11:51:18 -08:00
hppfs	switch open-coded instances of d_make_root() to new helper	2012-03-20 21:29:35 -04:00
hugetlbfs	hugetlbfs: fix mmap failure in unaligned size request	2013-05-19 10:54:48 -07:00
isofs	isofs: Fix unchecked printing of ER records	2015-04-14 17:33:47 +08:00
jbd	jbd: Fix lock ordering bug in journal_unmap_buffer()	2012-12-03 11:47:10 -08:00
jbd2	ext4/jbd2: don't wait (forever) for stale tid caused by wraparound	2014-03-11 16:10:05 -07:00
jffs2	jffs2: remove from wait queue after schedule()	2014-04-26 17:13:20 -07:00
jfs	jfs: fix error path in ialloc	2013-11-13 12:01:48 +09:00
lockd	lockd: Try to reconnect if statd has moved	2015-02-02 17:04:42 +08:00
logfs	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2012-03-21 13:36:41 -07:00
minix	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2012-03-21 13:36:41 -07:00
ncpfs	ncpfs: return proper error from NCP_IOC_SETROOT ioctl	2015-04-14 17:33:46 +08:00
nfs	NFSv4: Ensure that we remove NFSv4.0 delegations when state has expired	2015-02-02 17:05:20 +08:00
nfs_common
nfsd	nfsd: Fix slot wake up race in the nfsv4.1 callback code	2015-04-14 17:33:37 +08:00
nilfs2	nilfs2: fix data loss with mmap()	2014-12-01 18:02:38 +08:00
nls
notify	fanotify: enable close-on-exec on events' fd when requested in fanotify_init()	2015-02-02 17:04:49 +08:00
ntfs	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2012-03-21 13:36:41 -07:00
ocfs2	ocfs2: fix journal commit deadlock	2015-04-14 17:33:47 +08:00
omfs	switch open-coded instances of d_make_root() to new helper	2012-03-20 21:29:35 -04:00
openpromfs	switch open-coded instances of d_make_root() to new helper	2012-03-20 21:29:35 -04:00
proc	genirq: Prevent proc race against freeing of irq descriptors	2015-04-14 17:33:46 +08:00
pstore	pstore: Avoid deadlock in panic and emergency-restart path	2013-03-04 06:06:43 +08:00
qnx4	qnx4: new helper - try_extent()	2012-03-20 21:29:52 -04:00
qnx6	fs: initial qnx6fs addition	2012-03-20 21:29:38 -04:00
quota	quota: Fix race between dqput() and dquot_scan_active()	2014-03-11 16:10:02 -07:00
ramfs	fs: ramfs: file-nommu: add SetPageUptodate()	2012-07-16 09:04:45 -07:00
reiserfs	reiserfs: fix race in readdir	2014-05-06 07:51:44 -07:00
romfs	MTD merge for 3.4	2012-03-30 17:31:56 -07:00
squashfs	Add an extra mount time sanity check, plus some code cleanups and bug fixes.	2012-03-28 18:05:54 -07:00
sysfs	sysfs: fix use after free in case of concurrent read/write and readdir	2013-05-07 19:51:54 -07:00
sysv	switch open-coded instances of d_make_root() to new helper	2012-03-20 21:29:35 -04:00
ubifs	UBIFS: fix free log space calculation	2015-02-02 17:04:36 +08:00
udf	udf: Check component length before reading it	2015-04-14 17:33:48 +08:00
ufs	Remove all #inclusions of asm/system.h	2012-03-28 18:30:03 +01:00
xfs	xfs: underflow bug in xfs_attrlist_by_handle()	2013-12-20 07:34:19 -08:00
aio.c	aio: fix possible invalid memory access when DEBUG is enabled	2013-05-01 09:41:03 -07:00
anon_inodes.c	anon_inodes: move allocation of anon_inode into ->mount()	2012-03-20 21:29:45 -04:00
attr.c	vfs: increment iversion when a file is truncated	2012-06-10 00:36:12 +09:00
bad_inode.c	fs: reduce the use of module.h wherever possible	2012-02-28 19:31:58 -05:00
binfmt_aout.c	VM: add "vm_mmap()" helper function	2012-04-20 17:29:13 -07:00
binfmt_elf.c	coredump: prevent double-free on an error path in core dumper	2012-10-07 08:32:27 -07:00
binfmt_elf_fdpic.c	VM: add "vm_mmap()" helper function	2012-04-20 17:29:13 -07:00
binfmt_em86.c	exec: use -ELOOP for max recursion depth	2013-03-28 12:12:28 -07:00
binfmt_flat.c	VM: add "vm_mmap()" helper function	2012-04-20 17:29:13 -07:00
binfmt_misc.c	exec: use -ELOOP for max recursion depth	2013-03-28 12:12:28 -07:00
binfmt_script.c	exec: use -ELOOP for max recursion depth	2013-03-28 12:12:28 -07:00
binfmt_som.c	VM: add "vm_mmap()" helper function	2012-04-20 17:29:13 -07:00
bio-integrity.c	fs: remove the second argument of k[un]map_atomic()	2012-03-20 21:48:21 +08:00
bio.c	SCSI: sg: Fix user memory corruption when SG_IO is interrupted by a signal	2013-09-07 21:58:16 -07:00
block_dev.c	writeback: Fix periodic writeback after fs mount	2013-07-28 16:26:08 -07:00
buffer.c	vfs: fix data corruption when blocksize < pagesize for mmaped data	2015-02-02 17:04:52 +08:00
char_dev.c	char_dev.c: fix up some whitespace errors	2011-12-13 11:18:17 -08:00
compat.c	Fix: compat_rw_copy_check_uvector() misuse in aio, readv, writev, and security keys	2013-03-14 11:29:51 -07:00
compat_binfmt_elf.c
compat_ioctl.c	fs/compat_ioctl.c: VIDEO_SET_SPU_PALETTE missing error check	2012-10-31 10:02:55 -07:00
dcache.c	Nest rename_lock inside vfsmount_lock	2013-11-29 10:50:33 -08:00
dcookies.c	fs: reduce the use of module.h wherever possible	2012-02-28 19:31:58 -05:00
direct-io.c	fs: Fix possible use-after-free with AIO	2013-03-04 06:06:41 +08:00
drop_caches.c
eventfd.c	fs: reduce the use of module.h wherever possible	2012-02-28 19:31:58 -05:00
eventpoll.c	epoll: prevent missed events on EPOLL_CTL_MOD	2013-01-17 08:50:54 -08:00
exec.c	exec/ptrace: fix get_dumpable() incorrect tests	2013-11-29 10:50:34 -08:00
fcntl.c	Wrap accesses to the fd_sets in struct fdtable	2012-02-19 10:30:52 -08:00
fhandle.c	vfs: prefer ->dentry->d_sb to ->mnt->mnt_sb	2012-01-06 23:16:53 -05:00
fifo.c	fifo: Do not restart open() if it already found a partner	2012-07-19 08:58:56 -07:00
file.c	fs/file.c:fdtable: avoid triggering OOMs from alloc_fdmem	2014-02-22 10:32:45 -08:00
file_table.c	vfs: drop_file_write_access() made static	2012-03-20 21:29:32 -04:00
filesystems.c	vfs: convert fs_supers to hlist	2012-01-03 22:52:39 -05:00
fs-writeback.c	writeback: fix a subtle race condition in I_DIRTY clearing	2015-04-14 17:33:41 +08:00
fs_struct.c	The following text was taken from the original review request:	2012-03-24 10:24:31 -07:00
generic_acl.c
inode.c	vfs: Revert spurious fix to spinning prevention in prune_icache_sb	2013-04-16 21:27:26 -07:00
internal.h	vfs: protect remounting superblock read-only	2012-01-06 23:20:12 -05:00
ioctl.c	fs: reduce the use of module.h wherever possible	2012-02-28 19:31:58 -05:00
ioprio.c	block: Fix computation of merged request priority	2015-02-02 17:05:17 +08:00
Kconfig	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2012-03-21 13:36:41 -07:00
Kconfig.binfmt	fs: binfmt_elf: create Kconfig variable for PIE randomization	2012-01-10 16:30:51 -08:00
libfs.c	dentry leak in simple_fill_super() failure exit	2012-04-09 01:39:22 -04:00
locks.c	locks: allow __break_lease to sleep even when break_time is 0	2014-05-13 14:11:31 +02:00
Makefile	fs: initial qnx6fs addition	2012-03-20 21:29:38 -04:00
mbcache.c
mount.h	vfs: keep list of mounts for each superblock	2012-01-06 23:20:12 -05:00
mpage.c	fs: reduce the use of module.h wherever possible	2012-02-28 19:31:58 -05:00
namei.c	don't bugger nd->seq on set_root_rcu() from follow_dotdot_rcu()	2014-12-01 18:02:31 +08:00
namespace.c	mnt: Prevent pivot_root from creating a loop in the mount tree	2015-02-02 17:04:50 +08:00
no-block.c
open.c	vfs: canonicalize create mode in build_open_flags()	2012-09-14 10:00:05 -07:00
pipe.c	vfs: fix pipe counter breakage	2013-03-14 11:29:51 -07:00
pnode.c	get rid of propagate_umount() mistakenly treating slaves as busy.	2014-12-01 18:02:21 +08:00
pnode.h	vfs: switch pnode.h macros to struct mount *	2012-01-03 22:57:11 -05:00
posix_acl.c	posix_acl: handle NULL ACL in posix_acl_equiv_mode	2014-06-07 16:02:02 -07:00
proc_namespace.c	vfs: switch ->show_options() to struct dentry *	2012-01-06 23:19:54 -05:00
read_write.c	fs: reduce the use of module.h wherever possible	2012-02-28 19:31:58 -05:00
read_write.h
readdir.c	fs: reduce the use of module.h wherever possible	2012-02-28 19:31:58 -05:00
select.c	posix_types.h: Cleanup stale __NFDBITS and related definitions	2012-08-09 08:31:39 -07:00
seq_file.c	The following text was taken from the original review request:	2012-03-24 10:24:31 -07:00
signalfd.c	epoll: ep_unregister_pollwait() can use the freed pwq->whead	2012-02-24 11:42:50 -08:00
splice.c	tcp: fix MSG_SENDPAGE_NOTLAST logic	2013-01-11 09:07:14 -08:00
stack.c	fs: reduce the use of module.h wherever possible	2012-02-28 19:31:58 -05:00
stat.c	VFS: make vfs_fstat() use f[get|put]_light()	2014-06-07 16:02:04 -07:00
statfs.c	vfs: allow O_PATH file descriptors for fstatfs()	2013-10-22 09:02:25 +01:00
super.c	fs: Fix theoretical division by 0 in super_cache_scan().	2015-02-02 17:04:48 +08:00
sync.c	fs: reduce the use of module.h wherever possible	2012-02-28 19:31:58 -05:00
timerfd.c
utimes.c
xattr.c	fs/xattr.c:setxattr(): improve handling of allocation failures	2012-04-05 15:25:50 -07:00
xattr_acl.c	fs: reduce the use of module.h wherever possible	2012-02-28 19:31:58 -05:00