Merge tag 'affs-for-7.1-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux

torvalds · torvalds · commit f3756afb6f6c · 2026-04-13T16:39:01.000-07:00
Pull AFFS fix from David Sterba:
 "There's a potential out-of-bounds read in the directory hash table
  during readdir"

* tag 'affs-for-7.1-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux:
  affs: bound hash_pos before table lookup in affs_readdir
diff --git a/fs/affs/dir.c b/fs/affs/dir.c
@@ -119,6 +119,8 @@ affs_readdir(struct file *file, struct dir_context *ctx)
 		pr_debug("readdir() left off=%d\n", ino);
 		goto inside;
 	}
+	if (hash_pos >= AFFS_SB(sb)->s_hashsize)
+		goto done;
 
 	ino = be32_to_cpu(AFFS_HEAD(dir_bh)->table[hash_pos]);
 	for (i = 0; ino && i < chain_pos; i++) {

Original file line number	Diff line number	Diff line change
`@@ -119,6 +119,8 @@ affs_readdir(struct file file, struct dir_context ctx)`
`119`	`119`	`pr_debug("readdir() left off=%d\n", ino);`
`120`	`120`	`goto inside;`
`121`	`121`	`}`
	`122`	`+ if (hash_pos >= AFFS_SB(sb)->s_hashsize)`
	`123`	`+ goto done;`
`122`	`124`
`123`	`125`	`ino = be32_to_cpu(AFFS_HEAD(dir_bh)->table[hash_pos]);`
`124`	`126`	`for (i = 0; ino && i < chain_pos; i++) {`