diff options
| author | OGAWA Hirofumi <hirofumi@mail.parknet.co.jp> | 2015-11-21 02:57:15 +0300 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2016-02-20 01:28:24 +0300 |
| commit | f3fc333b58469ee6c4189e824fd7e15462b05cfc (patch) | |
| tree | 5548d63c44a9aa1ad6ddd04e946c3f6de78efb3c /fs/readdir.c | |
| parent | 525893dd243c0f765d2476e6ce3c601da124ff23 (diff) | |
| download | linux-f3fc333b58469ee6c4189e824fd7e15462b05cfc.tar.xz | |
fat: fix fake_offset handling on error path
commit 928a477102c4fc6739883415b66987207e3502f4 upstream.
For the root directory, . and .. are faked (using dir_emit_dots()) and
ctx->pos is reset from 2 to 0.
A corrupted root directory could cause fat_get_entry() to fail, but
->iterate() (fat_readdir()) reports progress to the VFS (with ctx->pos
rewound to 0), so any following calls to ->iterate() continue to return
the same entries again and again.
The result is that userspace will never see the end of the directory,
causing e.g. 'ls' to hang in a getdents() loop.
[hirofumi@mail.parknet.co.jp: cleanup and make sure to correct fake_offset]
Reported-by: Vegard Nossum <vegard.nossum@oracle.com>
Tested-by: Vegard Nossum <vegard.nossum@oracle.com>
Signed-off-by: Richard Weinberger <richard.weinberger@gmail.com>
Signed-off-by: OGAWA Hirofumi <hirofumi@mail.parknet.co.jp>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'fs/readdir.c')
0 files changed, 0 insertions, 0 deletions