From mboxrd@z Thu Jan 1 00:00:00 1970 From: Dan Carpenter Subject: [patch] hfs: copying wrong data in hfs_readdir() Date: Sat, 23 Jun 2012 12:14:46 +0300 Message-ID: <20120623091446.GA26923@elgon.mountain> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Cc: Miklos Szeredi , linux-fsdevel@vger.kernel.org, linux-kernel@vger.kernel.org, kernel-janitors@vger.kernel.org To: Al Viro Return-path: Content-Disposition: inline Sender: linux-kernel-owner@vger.kernel.org List-Id: linux-fsdevel.vger.kernel.org Smatch complains that this is copying stack data when then intent was to copy fd.key. The way I have written it matches how hfsplus_readdir() is implemented. Signed-off-by: Dan Carpenter --- I tried to test this, but to reach the memcpy() you would need to make one of the calls to filldir() fail and I don't know how to do that. I think that in the original code this would cause a crash when we call hfs_find_exit() diff --git a/fs/hfs/dir.c b/fs/hfs/dir.c index 62fc14e..f637bd5 100644 --- a/fs/hfs/dir.c +++ b/fs/hfs/dir.c @@ -162,7 +162,7 @@ static int hfs_readdir(struct file *filp, void *dirent, filldir_t filldir) rd->file = filp; list_add(&rd->list, &HFS_I(inode)->open_dir_list); } - memcpy(&rd->key, &fd.key, sizeof(struct hfs_cat_key)); + memcpy(&rd->key, fd.key, sizeof(struct hfs_cat_key)); out: hfs_find_exit(&fd); return err;