Forwarded: [PATCH] udf: propagate iteration error from udf_expand_dir_adinicb()

[syzbot <syzbot+969e250fc7983fc7417c@syzkaller.appspotmail.com>]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: [PATCH] udf: propagate iteration error from udf_expand_dir_adinicb()
Author: tristmd@gmail.com

From: Tristan Madani <tristan@talencesecurity.com>

#syz test: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master


udf_expand_dir_adinicb() copies inline directory data into a newly
allocated block and then re-iterates the directory entries to fixup tag
locations.  If the iteration fails (e.g. due to I/O error reading the
new block or corrupted on-disk data), the function hits a WARN_ON_ONCE()
and silently returns success.

On a crafted UDF image this WARNING fires reliably because the
underlying block read fails, causing udf_fiiter_init() or
udf_fiiter_advance() to return -EFSCORRUPTED.

Fix this by removing the WARN_ON_ONCE() and propagating the error code
to the caller instead, so that filesystem corruption is handled
gracefully rather than triggering a kernel warning.

Fixes: a27b2923de7e ("udf: Move udf_expand_dir_adinicb() to its callsite")
Reported-by: syzbot+969e250fc7983fc7417c@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=969e250fc7983fc7417c
Cc: stable@vger.kernel.org
Signed-off-by: Tristan Madani <tristan@talencesecurity.com>
---
 fs/udf/namei.c | 8 ++------
 1 file changed, 2 insertions(+), 6 deletions(-)

diff --git a/fs/udf/namei.c b/fs/udf/namei.c
--- a/fs/udf/namei.c
+++ b/fs/udf/namei.c
@@ -206,15 +206,11 @@ static int udf_expand_dir_adinicb(struct inode *inode, udf_pblk_t *block)
 		else
 			impuse = NULL;
 		udf_fiiter_write_fi(&iter, impuse);
 	}
 	brelse(dbh);
-	/*
-	 * We don't expect the iteration to fail as the directory has been
-	 * already verified to be correct
-	 */
-	WARN_ON_ONCE(ret);
 	udf_fiiter_release(&iter);

-	return 0;
+	return ret;
 }

 static int udf_fiiter_add_entry(struct inode *dir, struct dentry *dentry,
--
2.39.5