Merge branch 'ovl-fixes' into for-linus

Backmerge to resolve a conflict in ovl_lookup_real();
"ovl_lookup_real(): use lookup_one_len_unlocked()" instead,
but it was too late in the cycle to rebase.

3 files changed, 17 insertions, 5 deletions

diff --git a/fs/udf/super.c b/fs/udf/super.c
index fa92fe839fda..36661acaf33b 100644
--- a/fs/udf/super.c
+++ b/fs/udf/super.c
@@ -919,14 +919,14 @@ static int udf_load_pvoldesc(struct super_block *sb, sector_t block)
 #endif
         }
 
-        ret = udf_CS0toUTF8(outstr, 31, pvoldesc->volIdent, 32);
+        ret = udf_dstrCS0toUTF8(outstr, 31, pvoldesc->volIdent, 32);
         if (ret < 0)
                 goto out_bh;
 
         strncpy(UDF_SB(sb)->s_volume_ident, outstr, ret);
         udf_debug("volIdent[] = '%s'\n", UDF_SB(sb)->s_volume_ident);
 
-        ret = udf_CS0toUTF8(outstr, 127, pvoldesc->volSetIdent, 128);
+        ret = udf_dstrCS0toUTF8(outstr, 127, pvoldesc->volSetIdent, 128);
         if (ret < 0)
                 goto out_bh;
 
diff --git a/fs/udf/udfdecl.h b/fs/udf/udfdecl.h
index 972b70625614..263829ef1873 100644
--- a/fs/udf/udfdecl.h
+++ b/fs/udf/udfdecl.h
@@ -212,7 +212,7 @@ extern int udf_get_filename(struct super_block *, const uint8_t *, int,
                             uint8_t *, int);
 extern int udf_put_filename(struct super_block *, const uint8_t *, int,
                             uint8_t *, int);
-extern int udf_CS0toUTF8(uint8_t *, int, const uint8_t *, int);
+extern int udf_dstrCS0toUTF8(uint8_t *, int, const uint8_t *, int);
 
 /* ialloc.c */
 extern void udf_free_inode(struct inode *);
diff --git a/fs/udf/unicode.c b/fs/udf/unicode.c
index 3ff42f4437f3..695389a4fc23 100644
--- a/fs/udf/unicode.c
+++ b/fs/udf/unicode.c
@@ -335,9 +335,21 @@ try_again:
         return u_len;
 }
 
-int udf_CS0toUTF8(uint8_t *utf_o, int o_len, const uint8_t *ocu_i, int i_len)
+int udf_dstrCS0toUTF8(uint8_t *utf_o, int o_len,
+                      const uint8_t *ocu_i, int i_len)
 {
-        return udf_name_from_CS0(utf_o, o_len, ocu_i, i_len,
+        int s_len = 0;
+
+        if (i_len > 0) {
+                s_len = ocu_i[i_len - 1];
+                if (s_len >= i_len) {
+                        pr_err("incorrect dstring lengths (%d/%d)\n",
+                               s_len, i_len);
+                        return -EINVAL;
+                }
+        }
+
+        return udf_name_from_CS0(utf_o, o_len, ocu_i, s_len,
                                  udf_uni2char_utf8, 0);
 }