On Tue 09-11-21 16:26:46, Matthew Wilcox wrote: > On Tue, Nov 09, 2021 at 12:48:41PM +0100, Jan Kara wrote: > > udf_readdir() didn't validate the directory position it should start > > reading from. Thus when user uses lseek(2) on directory file descriptor > > it can trick udf_readdir() into reading from a position in the middle of > > directory entry which then upsets directory parsing code resulting in > > errors or even possible kernel crashes. Similarly when the directory is > > modified between two readdir calls, the directory position need not be > > valid anymore. > > ... We don't have an xfstest for this already? Actually, two. One for > lseek() and one for modifying the directory as it's being read. Good question which I also wanted to investigate. We do have generic/310 which tests the seek + readdir case (but for some reason it does not hit any problem with udf). Also tests using fsstress can in principle hit the readdir + dir modification case although because glibc implementation of readdir(3) does a lot of caching (directories smaller than 32k worth of dir entries are read in one go), hiting some problematic cornercase is rare I guess. So I guess the coverage needs some expansion. I'll have a look into it. Honza -- Jan Kara <jack@xxxxxxxx> SUSE Labs, CR
