For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject: [PATCH] udf: propagate iteration error from udf_expand_dir_adinicb()
Author: tristmd@gmail.com
From: Tristan Madani <tristan@talencesecurity.com>
#syz test: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
udf_expand_dir_adinicb() copies inline directory data into a newly
allocated block and then re-iterates the directory entries to fixup tag
locations. If the iteration fails (e.g. due to I/O error reading the
new block or corrupted on-disk data), the function hits a WARN_ON_ONCE()
and silently returns success.
On a crafted UDF image this WARNING fires reliably because the
underlying block read fails, causing udf_fiiter_init() or
udf_fiiter_advance() to return -EFSCORRUPTED.
Fix this by removing the WARN_ON_ONCE() and propagating the error code
to the caller instead, so that filesystem corruption is handled
gracefully rather than triggering a kernel warning.
Fixes: a27b2923de7e ("udf: Move udf_expand_dir_adinicb() to its callsite")
Reported-by: syzbot+969e250fc7983fc7417c@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=969e250fc7983fc7417c
Cc: stable@vger.kernel.org
Signed-off-by: Tristan Madani <tristan@talencesecurity.com>
---
fs/udf/namei.c | 8 ++------
1 file changed, 2 insertions(+), 6 deletions(-)
diff --git a/fs/udf/namei.c b/fs/udf/namei.c
--- a/fs/udf/namei.c
+++ b/fs/udf/namei.c
@@ -206,15 +206,11 @@ static int udf_expand_dir_adinicb(struct inode *inode, udf_pblk_t *block)
else
impuse = NULL;
udf_fiiter_write_fi(&iter, impuse);
}
brelse(dbh);
- /*
- * We don't expect the iteration to fail as the directory has been
- * already verified to be correct
- */
- WARN_ON_ONCE(ret);
udf_fiiter_release(&iter);
- return 0;
+ return ret;
}
static int udf_fiiter_add_entry(struct inode *dir, struct dentry *dentry,
--
2.39.5