lkml.org 
[lkml]   [2022]   [Jun]   [13]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.17 122/298] afs: Fix infinite loop found by xfstest generic/676
    Date
    From: David Howells <dhowells@redhat.com>

    [ Upstream commit 17eabd42560f4636648ad65ba5b20228071e2363 ]

    In AFS, a directory is handled as a file that the client downloads and
    parses locally for the purposes of performing lookup and getdents
    operations. The in-kernel afs filesystem has a number of functions that
    do this.

    A directory file is arranged as a series of 2K blocks divided into
    32-byte slots, where a directory entry occupies one or more slots, plus
    each block starts with one or more metadata blocks.

    When parsing a block, if the last slots are occupied by a dirent that
    occupies more than a single slot and the file position points at a slot
    that's not the initial one, the logic in afs_dir_iterate_block() that
    skips over it won't advance the file pointer to the end of it. This
    will cause an infinite loop in getdents() as it will keep retrying that
    block and failing to advance beyond the final entry.

    Fix this by advancing the file pointer if the next entry will be beyond
    it when we skip a block.

    This was found by the generic/676 xfstest but can also be triggered with
    something like:

    ~/xfstests-dev/src/t_readdir_3 /xfstest.test/z 4000 1

    Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
    Signed-off-by: David Howells <dhowells@redhat.com>
    Reviewed-by: Marc Dionne <marc.dionne@auristor.com>
    Tested-by: Marc Dionne <marc.dionne@auristor.com>
    cc: linux-afs@lists.infradead.org
    Link: http://lore.kernel.org/r/165391973497.110268.2939296942213894166.stgit@warthog.procyon.org.uk/
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    fs/afs/dir.c | 5 ++++-
    1 file changed, 4 insertions(+), 1 deletion(-)

    diff --git a/fs/afs/dir.c b/fs/afs/dir.c
    index da9b4f8577a1..7f1cb3b73874 100644
    --- a/fs/afs/dir.c
    +++ b/fs/afs/dir.c
    @@ -462,8 +462,11 @@ static int afs_dir_iterate_block(struct afs_vnode *dvnode,
    }

    /* skip if starts before the current position */
    - if (offset < curr)
    + if (offset < curr) {
    + if (next > curr)
    + ctx->pos = blkoff + next * sizeof(union afs_xdr_dirent);
    continue;
    + }

    /* found the next entry */
    if (!dir_emit(ctx, dire->u.name, nlen,
    --
    2.35.1


    \
     
     \ /
      Last update: 2022-06-13 16:28    [W:4.211 / U:0.016 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site