Re: [PATCH] udf: Fix crash after seekdir

[Jan Kara <jack@suse.cz>]

On Tue 09-11-21 16:26:46, Matthew Wilcox wrote:
> On Tue, Nov 09, 2021 at 12:48:41PM +0100, Jan Kara wrote:
> > udf_readdir() didn't validate the directory position it should start
> > reading from. Thus when user uses lseek(2) on directory file descriptor
> > it can trick udf_readdir() into reading from a position in the middle of
> > directory entry which then upsets directory parsing code resulting in
> > errors or even possible kernel crashes. Similarly when the directory is
> > modified between two readdir calls, the directory position need not be
> > valid anymore.
> 
> ... We don't have an xfstest for this already?  Actually, two.  One for
> lseek() and one for modifying the directory as it's being read.

Good question which I also wanted to investigate. We do have generic/310
which tests the seek + readdir case (but for some reason it does not hit
any problem with udf). Also tests using fsstress can in principle hit the
readdir + dir modification case although because glibc implementation of
readdir(3) does a lot of caching (directories smaller than 32k worth of dir
entries are read in one go), hiting some problematic cornercase is rare I
guess. So I guess the coverage needs some expansion.  I'll have a look into
it.

								Honza
-- 
Jan Kara <jack@suse.com>
SUSE Labs, CR