[PATCH] isofs: Always advance to the next block in readdir and lookup

[Matthias Goergens <matthias.goergens@gmail.com>]

Commit 3c01d9263683 ("isofs: Fix handling of directories with tight
blocks") made do_isofs_readdir() and isofs_find_entry() move on to the
next block with pos = round_up(pos, bufsize) both when a record ends
exactly at the end of the block and when the next length byte is zero.
In the second case pos is already block aligned if the zero byte is the
first byte of a block, so round_up() leaves it unchanged, the same block
is read again, and the loop never terminates. There is no
fatal_signal_pending() check in either loop, so the task spins at 100%
CPU and cannot be killed, and a second lookup of the same name blocks in
d_alloc_parallel() and trips the hung task detector.

A block that starts with a zero byte inside a directory is reachable
with a single-byte change to an image made by xorrisofs, and without
any corruption when the logical block size is 512 or 1024 bytes:
ECMA-119 zero-pads a directory only up to the end of the 2048-byte
logical sector, so the later logical blocks of a sector that is less
than full start with zero bytes and lie within the directory's size.

In both walkers pos equals (block << bufbits) + offset, so the next
block is simply block + 1. Advance to it directly, which is right for
both cases.

Fixes: 3c01d9263683 ("isofs: Fix handling of directories with tight blocks")
Signed-off-by: Matthias Goergens <matthias.goergens@gmail.com>
---
Jan, this is on top of your for_next; feel free to fold it into
3c01d9263683 instead if that is easier before you send it to Linus.

 fs/isofs/dir.c   | 4 ++--
 fs/isofs/namei.c | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/fs/isofs/dir.c b/fs/isofs/dir.c
index 5e541e765f547..28741251d56e3 100644
--- a/fs/isofs/dir.c
+++ b/fs/isofs/dir.c
@@ -119,8 +119,8 @@ static int do_isofs_readdir(struct inode *inode, struct file *file,
 		if (offset >= bufsize || de->length[0] == 0) {
 			brelse(bh);
 			bh = NULL;
-			ctx->pos = round_up(ctx->pos, bufsize);
-			block = ctx->pos >> bufbits;
+			block++;
+			ctx->pos = (loff_t)block << bufbits;
 			offset = 0;
 			continue;
 		}
diff --git a/fs/isofs/namei.c b/fs/isofs/namei.c
index e1c571478e8f5..4fba1bf7f0167 100644
--- a/fs/isofs/namei.c
+++ b/fs/isofs/namei.c
@@ -82,8 +82,8 @@ isofs_find_entry(struct inode *dir, struct dentry *dentry,
 		if (offset >= bufsize || de->length[0] == 0) {
 			brelse(bh);
 			bh = NULL;
-			f_pos = round_up(f_pos, bufsize);
-			block = f_pos >> bufbits;
+			block++;
+			f_pos = block << bufbits;
 			offset = 0;
 			continue;
 		}

base-commit: c8437ca3d4386af1ae1f2869643e82fdb9c1f0f5
-- 
2.55.0