diff options
| author | Yuezhang Mo <Yuezhang.Mo@sony.com> | 2022-09-22 09:43:47 +0300 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2023-03-11 18:39:56 +0300 |
| commit | c2d1997074ce3207cd779c26bc8b32b077d93085 (patch) | |
| tree | 0a4c2b5f43a7f2a91e5a0572af22bbc6a35d0c29 /fs | |
| parent | 34b05883414cc97e4c592988bb45225aede4ff63 (diff) | |
| download | linux-c2d1997074ce3207cd779c26bc8b32b077d93085.tar.xz | |
exfat: fix unexpected EOF while reading dir
commit 6cb5d1a16a51d080fbc1649a5144cbc5ca7d6f88 upstream.
If the position is not aligned with the dentry size, the return
value of readdir() will be NULL and errno is 0, which means the
end of the directory stream is reached.
If the position is aligned with dentry size, but there is no file
or directory at the position, exfat_readdir() will continue to
get dentry from the next dentry. So the dentry gotten by readdir()
may not be at the position.
After this commit, if the position is not aligned with the dentry
size, round the position up to the dentry size and continue to get
the dentry.
Fixes: ca06197382bd ("exfat: add directory operations")
Cc: stable@vger.kernel.org # v5.7+
Reported-by: Wang Yugui <wangyugui@e16-tech.com>
Signed-off-by: Yuezhang Mo <Yuezhang.Mo@sony.com>
Reviewed-by: Andy Wu <Andy.Wu@sony.com>
Reviewed-by: Aoyama Wataru <wataru.aoyama@sony.com>
Reviewed-by: Sungjong Seo <sj1557.seo@samsung.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'fs')
| -rw-r--r-- | fs/exfat/dir.c | 5 |
1 files changed, 1 insertions, 4 deletions
diff --git a/fs/exfat/dir.c b/fs/exfat/dir.c index 09c5ea4c4556..6caded58cda5 100644 --- a/fs/exfat/dir.c +++ b/fs/exfat/dir.c @@ -236,10 +236,7 @@ static int exfat_iterate(struct file *filp, struct dir_context *ctx) fake_offset = 1; } - if (cpos & (DENTRY_SIZE - 1)) { - err = -ENOENT; - goto unlock; - } + cpos = round_up(cpos, DENTRY_SIZE); /* name buffer should be allocated before use */ err = exfat_alloc_namebuf(nb); |