Commit f3756afb authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge tag 'affs-for-7.1-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux 

Pull AFFS fix from David Sterba:
 "There's a potential out-of-bounds read in the directory hash table
  during readdir"

* tag 'affs-for-7.1-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux:
  affs: bound hash_pos before table lookup in affs_readdir
parents c92b4d3d 6fa253b3

fs/affs/dir.c

+2 −0
Original line number Diff line number Diff line
@@ -119,6 +119,8 @@ affs_readdir(struct file *file, struct dir_context *ctx) 
		pr_debug("readdir() left off=%d\n", ino);

		goto inside;

	}

	if (hash_pos >= AFFS_SB(sb)->s_hashsize)

		goto done;



	ino = be32_to_cpu(AFFS_HEAD(dir_bh)->table[hash_pos]);

	for (i = 0; ino && i < chain_pos; i++) {