The branch main has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=3ff574c5e1d1d5d07763a14f22d6f9d7291550c6
commit 3ff574c5e1d1d5d07763a14f22d6f9d7291550c6 Author: Mark Johnston <[email protected]> AuthorDate: 2023-12-21 18:26:13 +0000 Commit: Mark Johnston <[email protected]> CommitDate: 2023-12-21 18:26:46 +0000 ufs: Update *eofflag upon a read of an unlinked directory If the directory is unlinked, no further entries will be returned, but we return no error. At least one caller (vn_dir_next_dirent()) asserts that a VOP_READDIR call which returns no error and no entries will set *eofflag != 0, so the current behaviour of UFS can trigger an assertion failure. Simply set *eofflag in this scenario. Reviewed by: olce, kib Reported by: syzkaller MFC after: 1 week Differential Revision: https://reviews.freebsd.org/D43089 --- sys/ufs/ufs/ufs_vnops.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/sys/ufs/ufs/ufs_vnops.c b/sys/ufs/ufs/ufs_vnops.c index 3bfa2019739a..c62583afaab6 100644 --- a/sys/ufs/ufs/ufs_vnops.c +++ b/sys/ufs/ufs/ufs_vnops.c @@ -2417,8 +2417,10 @@ ufs_readdir( if (uio->uio_offset < 0) return (EINVAL); ip = VTOI(vp); - if (ip->i_effnlink == 0) + if (ip->i_effnlink == 0) { + *ap->a_eofflag = 1; return (0); + } if (ap->a_ncookies != NULL) { if (uio->uio_resid < 0) ncookies = 0;
