aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorLinus Torvalds <torvalds@woody.linux-foundation.org>2008-01-11 11:49:31 -0800
committerLinus Torvalds <torvalds@woody.linux-foundation.org>2008-01-11 11:49:31 -0800
commit460c54b779fce3490ab70a84fd2ef59250ca3d57 (patch)
tree174f7a702fd765871678aa6ae82ab8f72ed34a67
parent5d0381e21ebf55df88e1cdca2810f4a49fe0ee62 (diff)
parentaea6ad0ce5e215ce99fe9e3edd9268f696862d8f (diff)
downloadlinux-stericsson-460c54b779fce3490ab70a84fd2ef59250ca3d57.tar.gz
Merge branch 'for-linus' of git://oss.sgi.com:8090/xfs/xfs-2.6
* 'for-linus' of git://oss.sgi.com:8090/xfs/xfs-2.6: [XFS] fix unaligned access in readdir
-rw-r--r--fs/xfs/linux-2.6/xfs_file.c16
1 files changed, 10 insertions, 6 deletions
diff --git a/fs/xfs/linux-2.6/xfs_file.c b/fs/xfs/linux-2.6/xfs_file.c
index 4847eb83fc18..21a1c2b1c5fc 100644
--- a/fs/xfs/linux-2.6/xfs_file.c
+++ b/fs/xfs/linux-2.6/xfs_file.c
@@ -261,9 +261,9 @@ xfs_file_readdir(
#else
struct hack_dirent {
- int namlen;
- loff_t offset;
u64 ino;
+ loff_t offset;
+ int namlen;
unsigned int d_type;
char name[];
};
@@ -285,8 +285,10 @@ xfs_hack_filldir(
{
struct hack_callback *buf = __buf;
struct hack_dirent *de = (struct hack_dirent *)(buf->dirent + buf->used);
+ unsigned int reclen;
- if (buf->used + sizeof(struct hack_dirent) + namlen > buf->len)
+ reclen = ALIGN(sizeof(struct hack_dirent) + namlen, sizeof(u64));
+ if (buf->used + reclen > buf->len)
return -EINVAL;
de->namlen = namlen;
@@ -294,7 +296,7 @@ xfs_hack_filldir(
de->ino = ino;
de->d_type = d_type;
memcpy(de->name, name, namlen);
- buf->used += sizeof(struct hack_dirent) + namlen;
+ buf->used += reclen;
return 0;
}
@@ -334,7 +336,8 @@ xfs_file_readdir(
offset = filp->f_pos;
while (!eof) {
- int reclen;
+ unsigned int reclen;
+
start_offset = offset;
buf.used = 0;
@@ -355,7 +358,8 @@ xfs_file_readdir(
goto done;
}
- reclen = sizeof(struct hack_dirent) + de->namlen;
+ reclen = ALIGN(sizeof(struct hack_dirent) + de->namlen,
+ sizeof(u64));
size -= reclen;
de = (struct hack_dirent *)((char *)de + reclen);
curr_offset = de->offset /* & 0x7fffffff */;