-----BEGIN PGP SIGNATURE-----
 
 iQEzBAABCAAdFiEEq1nRK9aeMoq1VSgcnJ2qBz9kQNkFAmjdD7MACgkQnJ2qBz9k
 QNl/rwf/ZpxWYEbZoMMrtoE+PTvlp7ato01oqPYeiX3ZJeHErkQVYtTL4RiV/12Q
 NrlZkc8PO9LWk+SqbKoylwo9XtpqT5UDPsmtudPZoJ0olxybJjHS4oTWsj5jBlZH
 IAqgo99rOa+O1o6G2HozUxVu+0L4Z50EkfL27zGNaunkaWh4YnjFkBMgyiVB5Vvh
 RSEMCN4YvkISyaVD/xa5fEDQ5KCCdVmUV6lLnZvfwXISNqEkgHz1kD3KwAfb3b7b
 iPm0NeQ20KOWcDkK3VyjYsFbvF29nQCTfiHv68zBfoEu7hrG0pC3x7/Bqem4uIo6
 TO5VgrqpohGk7O28Zu7LyxqmvPuwHw==
 =SWRE
 -----END PGP SIGNATURE-----

Merge tag 'fs_for_v6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs

Pull udf and quota updates from Jan Kara:
 "A fix for UDF and quota"

* tag 'fs_for_v6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs:
  fs: udf: fix OOB read in lengthAllocDescs handling
  fs: quota: create dedicated workqueue for quota_release_work
This commit is contained in:
Linus Torvalds 2025-10-03 13:44:05 -07:00
commit a4eb935648
2 changed files with 12 additions and 1 deletions

View File

@ -162,6 +162,9 @@ static struct quota_module_name module_names[] = INIT_QUOTA_MODULE_NAMES;
/* SLAB cache for dquot structures */
static struct kmem_cache *dquot_cachep;
/* workqueue for work quota_release_work*/
static struct workqueue_struct *quota_unbound_wq;
void register_quota_format(struct quota_format_type *fmt)
{
spin_lock(&dq_list_lock);
@ -881,7 +884,7 @@ void dqput(struct dquot *dquot)
put_releasing_dquots(dquot);
atomic_dec(&dquot->dq_count);
spin_unlock(&dq_list_lock);
queue_delayed_work(system_dfl_wq, &quota_release_work, 1);
queue_delayed_work(quota_unbound_wq, &quota_release_work, 1);
}
EXPORT_SYMBOL(dqput);
@ -3041,6 +3044,11 @@ static int __init dquot_init(void)
shrinker_register(dqcache_shrinker);
quota_unbound_wq = alloc_workqueue("quota_events_unbound",
WQ_UNBOUND | WQ_MEM_RECLAIM, WQ_MAX_ACTIVE);
if (!quota_unbound_wq)
panic("Cannot create quota_unbound_wq\n");
return 0;
}
fs_initcall(dquot_init);

View File

@ -2272,6 +2272,9 @@ int udf_current_aext(struct inode *inode, struct extent_position *epos,
if (check_add_overflow(sizeof(struct allocExtDesc),
le32_to_cpu(header->lengthAllocDescs), &alen))
return -1;
if (alen > epos->bh->b_size)
return -1;
}
switch (iinfo->i_alloc_type) {