From 6fa253b38b9b293a0de2a361de400557ca7666ca Mon Sep 17 00:00:00 2001 From: Hyungjung Joo Date: Fri, 13 Mar 2026 22:29:43 +0900 Subject: [PATCH] affs: bound hash_pos before table lookup in affs_readdir affs_readdir() decodes ctx->pos into hash_pos and chain_pos and then dereferences AFFS_HEAD(dir_bh)->table[hash_pos] before validating that hash_pos is within the runtime table bound. Treat out-of-range positions as end-of-directory before the first table lookup. Signed-off-by: Hyungjung Joo Reviewed-by: David Sterba Signed-off-by: David Sterba --- fs/affs/dir.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/fs/affs/dir.c b/fs/affs/dir.c index 5c8d83387a394..075c18c4ccde6 100644 --- a/fs/affs/dir.c +++ b/fs/affs/dir.c @@ -119,6 +119,8 @@ affs_readdir(struct file *file, struct dir_context *ctx) pr_debug("readdir() left off=%d\n", ino); goto inside; } + if (hash_pos >= AFFS_SB(sb)->s_hashsize) + goto done; ino = be32_to_cpu(AFFS_HEAD(dir_bh)->table[hash_pos]); for (i = 0; ino && i < chain_pos; i++) { -- 2.47.3