udf: prevent speculative execution

CVE-2017-5753
CVE-2017-5715

Real commit text tbd

Signed-off-by: Elena Reshetova <elena.reshetova@intel.com>
Signed-off-by: Tim Chen <tim.c.chen@linux.intel.com>
Signed-off-by: Andy Whitcroft <apw@canonical.com>
Signed-off-by: Kleber Sacilotto de Souza <kleber.souza@canonical.com>

diff --git a/fs/udf/misc.c b/fs/udf/misc.c
index 3949c4bec3a3ff3d13369b8930e1715bd86b196e..4bd10b2e8540a0b81fcf3b2980f9703e1bfd0c89 100644 (file)
--- a/fs/udf/misc.c
+++ b/fs/udf/misc.c
@@ -104,6 +104,8 @@ struct genericFormat *udf_add_extendedattr(struct inode *inode, uint32_t size,
                                        iinfo->i_lenEAttr) {
                                uint32_t aal =
                                        le32_to_cpu(eahd->appAttrLocation);
+
+                               gmb();
                                memmove(&ea[offset - aal + size],
                                        &ea[aal], offset - aal);
                                offset -= aal;
@@ -114,6 +116,8 @@ struct genericFormat *udf_add_extendedattr(struct inode *inode, uint32_t size,
                                        iinfo->i_lenEAttr) {
                                uint32_t ial =
                                        le32_to_cpu(eahd->impAttrLocation);
+
+                               gmb();
                                memmove(&ea[offset - ial + size],
                                        &ea[ial], offset - ial);
                                offset -= ial;
@@ -125,6 +129,8 @@ struct genericFormat *udf_add_extendedattr(struct inode *inode, uint32_t size,
                                        iinfo->i_lenEAttr) {
                                uint32_t aal =
                                        le32_to_cpu(eahd->appAttrLocation);
+
+                               gmb();
                                memmove(&ea[offset - aal + size],
                                        &ea[aal], offset - aal);
                                offset -= aal;