Commit eccbd5ac authored by Elena Reshetova's avatar Elena Reshetova Committed by Marcelo Henrique Cerri

udf: prevent speculative execution

CVE-2017-5753
CVE-2017-5715

Real commit text tbd
Signed-off-by: default avatarElena Reshetova <elena.reshetova@intel.com>
Signed-off-by: default avatarTim Chen <tim.c.chen@linux.intel.com>
Signed-off-by: default avatarAndy Whitcroft <apw@canonical.com>
(cherry picked from commit b1ff40b60f2b6c5e731b338d429fb06ef7087ace)
Signed-off-by: default avatarAndy Whitcroft <apw@canonical.com>
parent 021a73b4
......@@ -104,6 +104,8 @@ struct genericFormat *udf_add_extendedattr(struct inode *inode, uint32_t size,
iinfo->i_lenEAttr) {
uint32_t aal =
le32_to_cpu(eahd->appAttrLocation);
gmb();
memmove(&ea[offset - aal + size],
&ea[aal], offset - aal);
offset -= aal;
......@@ -114,6 +116,8 @@ struct genericFormat *udf_add_extendedattr(struct inode *inode, uint32_t size,
iinfo->i_lenEAttr) {
uint32_t ial =
le32_to_cpu(eahd->impAttrLocation);
gmb();
memmove(&ea[offset - ial + size],
&ea[ial], offset - ial);
offset -= ial;
......@@ -125,6 +129,8 @@ struct genericFormat *udf_add_extendedattr(struct inode *inode, uint32_t size,
iinfo->i_lenEAttr) {
uint32_t aal =
le32_to_cpu(eahd->appAttrLocation);
gmb();
memmove(&ea[offset - aal + size],
&ea[aal], offset - aal);
offset -= aal;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment