mirrors/linux
2
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2026-05-16 03:11:11 -04:00
Code Issues Packages Projects Releases Wiki Activity

affs: bound hash_pos before table lookup in affs_readdir

Browse Source 
affs_readdir() decodes ctx->pos into hash_pos and chain_pos and then
dereferences AFFS_HEAD(dir_bh)->table[hash_pos] before validating
that hash_pos is within the runtime table bound. Treat out-of-range
positions as end-of-directory before the first table lookup.

Signed-off-by: Hyungjung Joo <jhj140711@gmail.com>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
This commit is contained in:
Hyungjung Joo
2026-03-13 22:29:43 +09:00
committed by David Sterba
parent c369299895
commit 6fa253b38b
1 changed files with 2 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
fs/affs/dir.c
View File

@@ -119,6 +119,8 @@ affs_readdir(struct file *file, struct dir_context *ctx)
pr_debug("readdir() left off=%d\n", ino);
goto inside;
}
if (hash_pos >= AFFS_SB(sb)->s_hashsize)
goto done;
ino = be32_to_cpu(AFFS_HEAD(dir_bh)->table[hash_pos]);
for (i = 0; ino && i < chain_pos; i++) {