linux/fs/fat
OGAWA Hirofumi 928a477102 fat: fix fake_offset handling on error path
For the root directory, .  and ..  are faked (using dir_emit_dots()) and
ctx->pos is reset from 2 to 0.

A corrupted root directory could cause fat_get_entry() to fail, but
->iterate() (fat_readdir()) reports progress to the VFS (with ctx->pos
rewound to 0), so any following calls to ->iterate() continue to return
the same entries again and again.

The result is that userspace will never see the end of the directory,
causing e.g.  'ls' to hang in a getdents() loop.

[hirofumi@mail.parknet.co.jp: cleanup and make sure to correct fake_offset]
Reported-by: Vegard Nossum <vegard.nossum@oracle.com>
Tested-by: Vegard Nossum <vegard.nossum@oracle.com>
Signed-off-by: Richard Weinberger <richard.weinberger@gmail.com>
Signed-off-by: OGAWA Hirofumi <hirofumi@mail.parknet.co.jp>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2015-11-20 16:17:32 -08:00
..
cache.c
dir.c fat: fix fake_offset handling on error path 2015-11-20 16:17:32 -08:00
fat.h fs/fat: comment fix, fat_bits can be also 32 2015-04-17 09:04:06 -04:00
fatent.c
file.c writeback: separate out include/linux/backing-dev-defs.h 2015-06-02 08:33:34 -06:00
inode.c writeback: separate out include/linux/backing-dev-defs.h 2015-06-02 08:33:34 -06:00
Kconfig
Makefile
misc.c
namei_msdos.c Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs 2015-04-26 17:22:07 -07:00
namei_vfat.c Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs 2015-04-26 17:22:07 -07:00
nfs.c