Commit eccbd5ac authored by Elena Reshetova's avatar Elena Reshetova Committed by Marcelo Henrique Cerri

udf: prevent speculative execution

CVE-2017-5753
CVE-2017-5715

Real commit text tbd
Signed-off-by: default avatarElena Reshetova <elena.reshetova@intel.com>
Signed-off-by: default avatarTim Chen <tim.c.chen@linux.intel.com>
Signed-off-by: default avatarAndy Whitcroft <apw@canonical.com>
(cherry picked from commit b1ff40b60f2b6c5e731b338d429fb06ef7087ace)
Signed-off-by: default avatarAndy Whitcroft <apw@canonical.com>
parent 021a73b4
...@@ -104,6 +104,8 @@ struct genericFormat *udf_add_extendedattr(struct inode *inode, uint32_t size, ...@@ -104,6 +104,8 @@ struct genericFormat *udf_add_extendedattr(struct inode *inode, uint32_t size,
iinfo->i_lenEAttr) { iinfo->i_lenEAttr) {
uint32_t aal = uint32_t aal =
le32_to_cpu(eahd->appAttrLocation); le32_to_cpu(eahd->appAttrLocation);
gmb();
memmove(&ea[offset - aal + size], memmove(&ea[offset - aal + size],
&ea[aal], offset - aal); &ea[aal], offset - aal);
offset -= aal; offset -= aal;
...@@ -114,6 +116,8 @@ struct genericFormat *udf_add_extendedattr(struct inode *inode, uint32_t size, ...@@ -114,6 +116,8 @@ struct genericFormat *udf_add_extendedattr(struct inode *inode, uint32_t size,
iinfo->i_lenEAttr) { iinfo->i_lenEAttr) {
uint32_t ial = uint32_t ial =
le32_to_cpu(eahd->impAttrLocation); le32_to_cpu(eahd->impAttrLocation);
gmb();
memmove(&ea[offset - ial + size], memmove(&ea[offset - ial + size],
&ea[ial], offset - ial); &ea[ial], offset - ial);
offset -= ial; offset -= ial;
...@@ -125,6 +129,8 @@ struct genericFormat *udf_add_extendedattr(struct inode *inode, uint32_t size, ...@@ -125,6 +129,8 @@ struct genericFormat *udf_add_extendedattr(struct inode *inode, uint32_t size,
iinfo->i_lenEAttr) { iinfo->i_lenEAttr) {
uint32_t aal = uint32_t aal =
le32_to_cpu(eahd->appAttrLocation); le32_to_cpu(eahd->appAttrLocation);
gmb();
memmove(&ea[offset - aal + size], memmove(&ea[offset - aal + size],
&ea[aal], offset - aal); &ea[aal], offset - aal);
offset -= aal; offset -= aal;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment