Commit 460c54b7 authored by Linus Torvalds's avatar Linus Torvalds

Merge branch 'for-linus' of git://oss.sgi.com:8090/xfs/xfs-2.6

* 'for-linus' of git://oss.sgi.com:8090/xfs/xfs-2.6:
  [XFS] fix unaligned access in readdir
parents 5d0381e2 aea6ad0c
...@@ -261,9 +261,9 @@ xfs_file_readdir( ...@@ -261,9 +261,9 @@ xfs_file_readdir(
#else #else
struct hack_dirent { struct hack_dirent {
int namlen;
loff_t offset;
u64 ino; u64 ino;
loff_t offset;
int namlen;
unsigned int d_type; unsigned int d_type;
char name[]; char name[];
}; };
...@@ -285,8 +285,10 @@ xfs_hack_filldir( ...@@ -285,8 +285,10 @@ xfs_hack_filldir(
{ {
struct hack_callback *buf = __buf; struct hack_callback *buf = __buf;
struct hack_dirent *de = (struct hack_dirent *)(buf->dirent + buf->used); struct hack_dirent *de = (struct hack_dirent *)(buf->dirent + buf->used);
unsigned int reclen;
if (buf->used + sizeof(struct hack_dirent) + namlen > buf->len) reclen = ALIGN(sizeof(struct hack_dirent) + namlen, sizeof(u64));
if (buf->used + reclen > buf->len)
return -EINVAL; return -EINVAL;
de->namlen = namlen; de->namlen = namlen;
...@@ -294,7 +296,7 @@ xfs_hack_filldir( ...@@ -294,7 +296,7 @@ xfs_hack_filldir(
de->ino = ino; de->ino = ino;
de->d_type = d_type; de->d_type = d_type;
memcpy(de->name, name, namlen); memcpy(de->name, name, namlen);
buf->used += sizeof(struct hack_dirent) + namlen; buf->used += reclen;
return 0; return 0;
} }
...@@ -334,7 +336,8 @@ xfs_file_readdir( ...@@ -334,7 +336,8 @@ xfs_file_readdir(
offset = filp->f_pos; offset = filp->f_pos;
while (!eof) { while (!eof) {
int reclen; unsigned int reclen;
start_offset = offset; start_offset = offset;
buf.used = 0; buf.used = 0;
...@@ -355,7 +358,8 @@ xfs_file_readdir( ...@@ -355,7 +358,8 @@ xfs_file_readdir(
goto done; goto done;
} }
reclen = sizeof(struct hack_dirent) + de->namlen; reclen = ALIGN(sizeof(struct hack_dirent) + de->namlen,
sizeof(u64));
size -= reclen; size -= reclen;
de = (struct hack_dirent *)((char *)de + reclen); de = (struct hack_dirent *)((char *)de + reclen);
curr_offset = de->offset /* & 0x7fffffff */; curr_offset = de->offset /* & 0x7fffffff */;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment