On Tue, Nov 09, 2021 at 12:48:41PM +0100, Jan Kara wrote: > udf_readdir() didn't validate the directory position it should start > reading from. Thus when user uses lseek(2) on directory file descriptor > it can trick udf_readdir() into reading from a position in the middle of > directory entry which then upsets directory parsing code resulting in > errors or even possible kernel crashes. Similarly when the directory is > modified between two readdir calls, the directory position need not be > valid anymore. ... We don't have an xfstest for this already? Actually, two. One for lseek() and one for modifying the directory as it's being read.
