From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id BE6A8206F18; Tue, 8 Apr 2025 12:23:10 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1744114990; cv=none; b=Sab6pQZet9QrX1n8hODnXoOD3i+OXJqUZU6uYU7U/duoP8e672CCo1BLzANiiXeMpAEk4LMsj+OR3ThzxDrOJtcpVwrzA0v+iM8ANS/I4H8FASrn4Ai4fouIh87EJKI9H/ZPrWST6HVDtPO+1LVTa6NMsAulqoy19dx9f+TsFsc= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1744114990; c=relaxed/simple; bh=dMydW9BeWyRGqTP2lXTRlUbVYkVUe4ioTbP1Fa7NxBE=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=nClnYQOO7rnlMpueR45JzcUJbIqui4uZwyiS7ksd44/bz0cGQzBUGbZeE0s9/UrX0SiXA9ib5HQIyK770dJY2fhpwoB86EkN9hfLFHIOV7Aj1Jsyp1iJnzOOLbKws0//aWebgbroDoliSxemMYh2icn/QnubBU00u09b2bx6erA= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=WdL8ywvA; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="WdL8ywvA" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 28F30C4CEE5; Tue, 8 Apr 2025 12:23:10 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1744114990; bh=dMydW9BeWyRGqTP2lXTRlUbVYkVUe4ioTbP1Fa7NxBE=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=WdL8ywvAQGbhz6/gNCmEnODwq+jjBKYgJsedBx1pNxYuW0JfTdLUZiT7myNIUuJ9p TSHlxUNu0b5p/uDLk2acByj2fy8P7FO64PlNrNwz+G1g2Kf/JzikfGCNYC+KXLiUA5 ifvXomnYzPGfROGobp7x3gCvYzuOiJEqXGQdjX9s= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Simon Tatham , David Sterba , Sasha Levin Subject: [PATCH 6.13 310/499] affs: dont write overlarge OFS data block size fields Date: Tue, 8 Apr 2025 12:48:42 +0200 Message-ID: <20250408104858.948532877@linuxfoundation.org> X-Mailer: git-send-email 2.49.0 In-Reply-To: <20250408104851.256868745@linuxfoundation.org> References: <20250408104851.256868745@linuxfoundation.org> User-Agent: quilt/0.68 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: stable@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 6.13-stable review patch. If anyone has any objections, please let me know. ------------------ From: Simon Tatham [ Upstream commit 011ea742a25a77bac3d995f457886a67d178c6f0 ] If a data sector on an OFS floppy contains a value > 0x1e8 (the largest amount of data that fits in the sector after its header), then an Amiga reading the file can return corrupt data, by taking the overlarge size at its word and reading past the end of the buffer it read the disk sector into! The cause: when affs_write_end_ofs() writes data to an OFS filesystem, the new size field for a data block was computed by adding the amount of data currently being written (into the block) to the existing value of the size field. This is correct if you're extending the file at the end, but if you seek backwards in the file and overwrite _existing_ data, it can lead to the size field being larger than the maximum legal value. This commit changes the calculation so that it sets the size field to the max of its previous size and the position within the block that we just wrote up to. Signed-off-by: Simon Tatham Signed-off-by: David Sterba Signed-off-by: Sasha Levin --- fs/affs/file.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/fs/affs/file.c b/fs/affs/file.c index 226308f8627e7..7a71018e3f675 100644 --- a/fs/affs/file.c +++ b/fs/affs/file.c @@ -724,7 +724,8 @@ static int affs_write_end_ofs(struct file *file, struct address_space *mapping, tmp = min(bsize - boff, to - from); BUG_ON(boff + tmp > bsize || tmp > bsize); memcpy(AFFS_DATA(bh) + boff, data + from, tmp); - be32_add_cpu(&AFFS_DATA_HEAD(bh)->size, tmp); + AFFS_DATA_HEAD(bh)->size = cpu_to_be32( + max(boff + tmp, be32_to_cpu(AFFS_DATA_HEAD(bh)->size))); affs_fix_checksum(sb, bh); mark_buffer_dirty_inode(bh, inode); written += tmp; -- 2.39.5