commit a4eb9356480fa47618e597a43284c52ac6023f28
author Linus Torvalds <torvalds@linux-foundation.org> Fri Oct 03 13:44:05 2025 -0700
committer Linus Torvalds <torvalds@linux-foundation.org> Fri Oct 03 13:44:05 2025 -0700
tree 61f6c305287b6bb7b211b64ca039b23bcff19e79
parent 67f5f11cdf5081af9b592d8ab24d054a0d681b2f
parent 3bd5e45c2ce30e239d596becd5db720f7eb83c99

Merge tag 'fs_for_v6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs

Pull udf and quota updates from Jan Kara:
 "A fix for UDF and quota"

* tag 'fs_for_v6.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs:
  fs: udf: fix OOB read in lengthAllocDescs handling
  fs: quota: create dedicated workqueue for quota_release_work

fs/quota/dquot.c

diff --git a/fs/quota/dquot.c b/fs/quota/dquot.c
index afa15a2..6c4a6ee 100644
--- a/fs/quota/dquot.c
+++ b/fs/quota/dquot.c
@@ -162,6 +162,9 @@ static struct quota_module_name module_names[] = INIT_QUOTA_MODULE_NAMES;
 /* SLAB cache for dquot structures */
 static struct kmem_cache *dquot_cachep;
 
+/* workqueue for work quota_release_work*/
+static struct workqueue_struct *quota_unbound_wq;
+
 void register_quota_format(struct quota_format_type *fmt)
 {
 	spin_lock(&dq_list_lock);
@@ -881,7 +884,7 @@ void dqput(struct dquot *dquot)
 	put_releasing_dquots(dquot);
 	atomic_dec(&dquot->dq_count);
 	spin_unlock(&dq_list_lock);
-	queue_delayed_work(system_dfl_wq, &quota_release_work, 1);
+	queue_delayed_work(quota_unbound_wq, &quota_release_work, 1);
 }
 EXPORT_SYMBOL(dqput);
 
@@ -3041,6 +3044,11 @@ static int __init dquot_init(void)
 
 	shrinker_register(dqcache_shrinker);
 
+	quota_unbound_wq = alloc_workqueue("quota_events_unbound",
+					   WQ_UNBOUND | WQ_MEM_RECLAIM, WQ_MAX_ACTIVE);
+	if (!quota_unbound_wq)
+		panic("Cannot create quota_unbound_wq\n");
+
 	return 0;
 }
 fs_initcall(dquot_init);

fs/udf/inode.c

diff --git a/fs/udf/inode.c b/fs/udf/inode.c
index f24aa98..a79d73f 100644
--- a/fs/udf/inode.c
+++ b/fs/udf/inode.c
@@ -2272,6 +2272,9 @@ int udf_current_aext(struct inode *inode, struct extent_position *epos,
 		if (check_add_overflow(sizeof(struct allocExtDesc),
 				le32_to_cpu(header->lengthAllocDescs), &alen))
 			return -1;
+
+		if (alen > epos->bh->b_size)
+			return -1;
 	}
 
 	switch (iinfo->i_alloc_type) {