[PATCH] more VFAT_IOCTL_READDIR_BOTH/_SHORT ioctl fixes (1/11)

    - check the ioctl cmd first
    - check the directory whether it's an already dead

fs/fat/dir.c

@@ -647,9 +647,23 @@ int fat_dir_ioctl(struct inode * inode, struct file * filp,
 		  unsigned int cmd, unsigned long arg)
 {
 	struct fat_ioctl_filldir_callback buf;
-	struct dirent __user *d1 = (struct dirent *)arg;
+	struct dirent __user *d1;
 	int ret, shortname, both;
 
+	switch (cmd) {
+	case VFAT_IOCTL_READDIR_SHORT:
+		shortname = 1;
+		both = 1;
+		break;
+	case VFAT_IOCTL_READDIR_BOTH:
+		shortname = 0;
+		both = 1;
+		break;
+	default:
+		return -EINVAL;
+	}
+
+	d1 = (struct dirent *)arg;
 	if (!access_ok(VERIFY_WRITE, d1, sizeof(struct dirent[2])))
 		return -EFAULT;
 	/*
@@ -662,20 +676,13 @@ int fat_dir_ioctl(struct inode * inode, struct file * filp,
 
 	buf.dirent = d1;
 	buf.result = 0;
-	switch (cmd) {
-	case VFAT_IOCTL_READDIR_SHORT:
-		shortname = 1;
-		both = 1;
-		break;
-	case VFAT_IOCTL_READDIR_BOTH:
-		shortname = 0;
-		both = 1;
-		break;
-	default:
-		return -EINVAL;
+	down(&inode->i_sem);
+	ret = -ENOENT;
+	if (!IS_DEADDIR(inode)) {
+		ret = fat_readdirx(inode, filp, &buf, fat_ioctl_filldir,
+				   shortname, both);
 	}
-	ret = fat_readdirx(inode, filp, &buf, fat_ioctl_filldir,
-			   shortname, both);
+	up(&inode->i_sem);
 	if (ret >= 0)
 		ret = buf.result;
 	return ret;