[PATCH] fs/ntfs3: fix endless readdir loop on a directory without a $BITMAP

[PATCH] fs/ntfs3: fix endless readdir loop on a directory without a $BITMAP

[Wahid Khan]

ntfs_readdir() saves ctx->pos in "pos" before it emits "." and "..".
If indx_used_bit() returns -ENOENT, the exit path puts that stale value
back into ctx->pos and returns 0, although the dot entries were already
copied to user space. The next getdents64() call starts at the same
position and emits them again, so a reader of the directory never sees
the end of it. ls, find and rm -r spin forever.

indx_used_bit() returns -ENOENT when the directory has no $BITMAP
attribute named $I30. That is a damaged directory, but it simply means
that no index block is in use, and indx_find_sort() already treats it
that way. Do the same in ntfs_readdir() and end the enumeration.

Reproduced under KASAN with a crafted image: changing the first
character of the $I30 name of the $BITMAP attribute in the root
directory's MFT record is enough.

Fixes: 4342306f0f0d ("fs/ntfs3: Add file operations and implementation")
Cc: stable@vger.kernel.org
Signed-off-by: Wahid Khan <wahidzk0091@gmail.com>
---
 fs/ntfs3/dir.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/fs/ntfs3/dir.c b/fs/ntfs3/dir.c
index 7ee1a5d4189e..dafd309e136d 100644
--- a/fs/ntfs3/dir.c
+++ b/fs/ntfs3/dir.c
@@ -584,6 +584,11 @@ static int ntfs_readdir(struct file *file, struct dir_context *ctx)
 	for (; bit < max_bit; bit += 1) {
 		/* Get the next used index. */
 		err = indx_used_bit(&ni->dir, ni, &bit);
+		if (err == -ENOENT) {
+			/* No $BITMAP, so no used indexes. End of dir. */
+			err = 0;
+			break;
+		}
 		if (err)
 			goto out;
 
-- 
2.56.0