diff options
| author | Jan Kara <jack@suse.cz> | 2017-06-13 15:54:58 +0200 |
|---|---|---|
| committer | Jan Kara <jack@suse.cz> | 2017-06-14 11:21:01 +0200 |
| commit | 9795e0e8ac0d6a3ee092f1b555b284b57feef99e (patch) | |
| tree | ce1fa5f47b7b24d04d4893528eae522ce1885023 /ipc | |
| parent | a247f7236d06f504e57637b8ec124fc1af226d08 (diff) | |
| download | linux-9795e0e8ac0d6a3ee092f1b555b284b57feef99e.tar.gz linux-9795e0e8ac0d6a3ee092f1b555b284b57feef99e.tar.bz2 linux-9795e0e8ac0d6a3ee092f1b555b284b57feef99e.zip | |
udf: Fix races with i_size changes during readpage
__udf_adinicb_readpage() uses i_size several times. When truncate
changes i_size while the function is running, it can observe several
different values and thus e.g. expose uninitialized parts of page to
userspace. Also use i_size_read() in the function since it does not hold
inode_lock. Since i_size is guaranteed to be small, this cannot really
cause any issues even on 32-bit archs but let's be careful.
CC: stable@vger.kernel.org
Fixes: 9c2fc0de1a6e638fe58c354a463f544f42a90a09
Signed-off-by: Jan Kara <jack@suse.cz>
Diffstat (limited to 'ipc')
0 files changed, 0 insertions, 0 deletions