CVE-2024-46701

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> libfs: fix infinite directory reads for offset dir<br /> <br /> After we switch tmpfs dir operations from simple_dir_operations to<br /> simple_offset_dir_operations, every rename happened will fill new dentry<br /> to dest dir&amp;#39;s maple tree(&amp;SHMEM_I(inode)-&gt;dir_offsets-&gt;mt) with a free<br /> key starting with octx-&gt;newx_offset, and then set newx_offset equals to<br /> free key + 1. This will lead to infinite readdir combine with rename<br /> happened at the same time, which fail generic/736 in xfstests(detail show<br /> as below).<br /> <br /> 1. create 5000 files(1 2 3...) under one dir<br /> 2. call readdir(man 3 readdir) once, and get one entry<br /> 3. rename(entry, "TEMPFILE"), then rename("TEMPFILE", entry)<br /> 4. loop 2~3, until readdir return nothing or we loop too many<br /> times(tmpfs break test with the second condition)<br /> <br /> We choose the same logic what commit 9b378f6ad48cf ("btrfs: fix infinite<br /> directory reads") to fix it, record the last_index when we open dir, and<br /> do not emit the entry which index &gt;= last_index. The file-&gt;private_data<br /> now used in offset dir can use directly to do this, and we also update<br /> the last_index when we llseek the dir file.<br /> <br /> [brauner: only update last_index after seek when offset is zero like Jan suggested]