diff options
| author | Yuezhang Mo <Yuezhang.Mo@sony.com> | 2024-12-13 13:08:37 +0800 |
|---|---|---|
| committer | Namjae Jeon <linkinjeon@kernel.org> | 2024-12-31 17:49:40 +0900 |
| commit | fee873761bd978d077d8c55334b4966ac4cb7b59 (patch) | |
| tree | e3cdf91d80cad81dbf118239129d76ce02dd06d8 /fs/exfat | |
| parent | 70465acbb0ce1bb69447acf32f136c8153cda0de (diff) | |
| download | linux-stable-fee873761bd978d077d8c55334b4966ac4cb7b59.tar.gz linux-stable-fee873761bd978d077d8c55334b4966ac4cb7b59.tar.bz2 linux-stable-fee873761bd978d077d8c55334b4966ac4cb7b59.zip | |
exfat: fix the infinite loop in exfat_readdir()
If the file system is corrupted so that a cluster is linked to
itself in the cluster chain, and there is an unused directory
entry in the cluster, 'dentry' will not be incremented, causing
condition 'dentry < max_dentries' unable to prevent an infinite
loop.
This infinite loop causes s_lock not to be released, and other
tasks will hang, such as exfat_sync_fs().
This commit stops traversing the cluster chain when there is unused
directory entry in the cluster to avoid this infinite loop.
Reported-by: syzbot+205c2644abdff9d3f9fc@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=205c2644abdff9d3f9fc
Tested-by: syzbot+205c2644abdff9d3f9fc@syzkaller.appspotmail.com
Fixes: ca06197382bd ("exfat: add directory operations")
Signed-off-by: Yuezhang Mo <Yuezhang.Mo@sony.com>
Reviewed-by: Sungjong Seo <sj1557.seo@samsung.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Diffstat (limited to 'fs/exfat')
| -rw-r--r-- | fs/exfat/dir.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/fs/exfat/dir.c b/fs/exfat/dir.c index fe0a9b8a0cd0..3103b932b674 100644 --- a/fs/exfat/dir.c +++ b/fs/exfat/dir.c @@ -122,7 +122,7 @@ static int exfat_readdir(struct inode *inode, loff_t *cpos, struct exfat_dir_ent type = exfat_get_entry_type(ep); if (type == TYPE_UNUSED) { brelse(bh); - break; + goto out; } if (type != TYPE_FILE && type != TYPE_DIR) { @@ -170,6 +170,7 @@ static int exfat_readdir(struct inode *inode, loff_t *cpos, struct exfat_dir_ent } } +out: dir_entry->namebuf.lfn[0] = '\0'; *cpos = EXFAT_DEN_TO_B(dentry); return 0; |