Commit 08cf4a8181b4 ("exfat: use exfat_chain_advance helper") made the directory code walk the clusters of a directory with exfat_chain_advance(). However, exfat_chain_advance() returns -EIO once it has walked as many clusters as the size of the directory says. The FAT chain of a directory can be longer than that, because some cameras stop updating the size, see commit 1e5654de0f51 ("exfat: handle wrong stream entry size in exfat_readdir()"). As of now, opening such a directory fails with EIO as soon as the chain is two clusters longer than the size. Reading a directory that has a FAT chain after a seek past its end fails with EIO too. The issue can be reproduced with an image in which the size of a directory with 200 files and 7 clusters is lowered to 2 clusters: mount -o loop exfat.img /mnt ls /mnt/d | wc -l Before commit 08cf4a8181b4 ("exfat: use exfat_chain_advance helper"), the result is: 200 After that commit, ls fails with "Input/output error" and the result is: 0 This patch will make exfat_chain_advance() follow the FAT to its end when the directory has a FAT chain, as the code did before, and keep the size check for a directory without one. Fixes: 08cf4a8181b4 ("exfat: use exfat_chain_advance helper") Cc: stable@vger.kernel.org Signed-off-by: Hengyu Liang --- fs/exfat/exfat_fs.h | 28 +++++++++++++++++++--------- 1 file changed, 19 insertions(+), 9 deletions(-) diff --git a/fs/exfat/exfat_fs.h b/fs/exfat/exfat_fs.h index a9131fe03302..f324c4cba26a 100644 --- a/fs/exfat/exfat_fs.h +++ b/fs/exfat/exfat_fs.h @@ -623,19 +623,29 @@ static inline int exfat_chain_advance(struct super_block *sb, struct exfat_chain *chain, unsigned int step) { unsigned int clu = chain->dir; + unsigned int i; - if (unlikely(chain->size < step)) - return -EIO; + if (chain->flags == ALLOC_NO_FAT_CHAIN) { + if (unlikely(chain->size < step)) + return -EIO; - if (exfat_cluster_walk(sb, &clu, step, chain->flags)) - return -EIO; + chain->size -= step; + chain->dir = chain->size ? clu + step : EXFAT_EOF_CLUSTER; + return 0; + } - chain->size -= step; + /* + * Only the FAT tells where a chain of this kind ends. The size can be + * smaller than the chain, see commit 1e5654de0f51 ("exfat: handle + * wrong stream entry size in exfat_readdir()"). + */ + for (i = 0; i < step && clu != EXFAT_EOF_CLUSTER; i++) { + if (exfat_get_next_cluster(sb, &clu)) + return -EIO; + } - if (chain->size == 0 && chain->flags == ALLOC_NO_FAT_CHAIN) - chain->dir = EXFAT_EOF_CLUSTER; - else - chain->dir = clu; + chain->size -= min(chain->size, step); + chain->dir = clu; return 0; } -- 2.53.0