[3/4,for,5.15,stable] btrfs: refresh dir last index during a rewinddir(3) call

Commit Message

Filipe Manana Jan. 25, 2024, 11:59 a.m. UTC

From: Filipe Manana <[e-mail]>

commit e60aa5da14d01fed8411202dbe4adf6c44bd2a57 upstream.

When opening a directory we find what's the index of its last entry and
then store it in the directory's file handle private data (struct
btrfs_file_private::last_index), so that in the case new directory entries
are added to a directory after an opendir(3) call we don't end up in an
infinite loop (see commit 9b378f6ad48c ("btrfs: fix infinite directory
reads")) when calling readdir(3).

However once rewinddir(3) is called, POSIX states [1] that any new
directory entries added after the previous opendir(3) call, must be
returned by subsequent calls to readdir(3):

  "The rewinddir() function shall reset the position of the directory
   stream to which dirp refers to the beginning of the directory.
   It shall also cause the directory stream to refer to the current
   state of the corresponding directory, as a call to opendir() would
   have done."

We currently don't refresh the last_index field of the struct
btrfs_file_private associated to the directory, so after a rewinddir(3)
we are not returning any new entries added after the opendir(3) call.

Fix this by finding the current last index of the directory when llseek
is called against the directory.

This can be reproduced by the following C program provided by Ian Johnson:

   #include <dirent.h>
   #include <stdio.h>

   int main(void) {
     DIR *dir = opendir("test");

     FILE *file;
     file = fopen("test/1", "w");
     fwrite("1", 1, 1, file);
     fclose(file);

     file = fopen("test/2", "w");
     fwrite("2", 1, 1, file);
     fclose(file);

     rewinddir(dir);

     struct dirent *entry;
     while ((entry = readdir(dir))) {
        printf("%s\n", entry->d_name);
     }
     closedir(dir);
     return 0;
   }

Reported-by: Ian Johnson <[e-mail]>
Link: https://lore.kernel.org/linux-btrfs/[e-mail]/
Fixes: 9b378f6ad48c ("btrfs: fix infinite directory reads")
CC: [e-mail] # 6.5+
Signed-off-by: Filipe Manana <[e-mail]>
Signed-off-by: David Sterba <[e-mail]>
---
 fs/btrfs/inode.c | 15 ++++++++++++++-
 1 file changed, 14 insertions(+), 1 deletion(-)

Comments

Eugeniu Rosca Jan. 26, 2024, 7:08 p.m. UTC | #1

On Thu, Jan 25, 2024 at 11:59:37AM +0000, [e-mail] wrote:
> From: Filipe Manana <[e-mail]>
> 
> commit e60aa5da14d01fed8411202dbe4adf6c44bd2a57 upstream.
> 
> When opening a directory we find what's the index of its last entry and
> then store it in the directory's file handle private data (struct
> btrfs_file_private::last_index), so that in the case new directory entries
> are added to a directory after an opendir(3) call we don't end up in an
> infinite loop (see commit 9b378f6ad48c ("btrfs: fix infinite directory
> reads")) when calling readdir(3).

[..]

> Fixes: 9b378f6ad48c ("btrfs: fix infinite directory reads")
> CC: [e-mail] # 6.5+
> Signed-off-by: Filipe Manana <[e-mail]>
> Signed-off-by: David Sterba <[e-mail]>

Based on https://lore.kernel.org/stable/20240126185534.GA2668448@lxhi-087:

Reviewed-by: Eugeniu Rosca <[e-mail]>

Patch

diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
index b144e346f24c..b7047604d255 100644
--- a/fs/btrfs/inode.c
+++ b/fs/btrfs/inode.c
@@ -6222,6 +6222,19 @@  static int btrfs_opendir(struct inode *inode, struct file *file)
 	return 0;
 }
 
+static loff_t btrfs_dir_llseek(struct file *file, loff_t offset, int whence)
+{
+	struct btrfs_file_private *private = file->private_data;
+	int ret;
+
+	ret = btrfs_get_dir_last_index(BTRFS_I(file_inode(file)),
+				       &private->last_index);
+	if (ret)
+		return ret;
+
+	return generic_file_llseek(file, offset, whence);
+}
+
 struct dir_entry {
 	u64 ino;
 	u64 offset;
@@ -11087,7 +11100,7 @@  static const struct inode_operations btrfs_dir_inode_operations = {
 };
 
 static const struct file_operations btrfs_dir_file_operations = {
-	.llseek		= generic_file_llseek,
+	.llseek		= btrfs_dir_llseek,
 	.read		= generic_read_dir,
 	.iterate_shared	= btrfs_real_readdir,
 	.open		= btrfs_opendir,