When UDF directory entry is invalid, udf_fiiter_advance() will first update iter->pos to point to it and then report error. However udf_readdir() will not store iter->pos to ctx->pos in this case and hence next udf_readdir() call will again emit the last correct directory entry and fail again thus looping indefinitely. Store the current position in ctx->pos whenever it was determined as valid, even if the current entry is corrupted to ensure progress beyond the last correct entry. Reported-by: Scott Carter Link: https://lore.kernel.org/all/CA+UmNqbcPPegp=x8rsV8t3mbOsseknKo54=fsru6gb3PQjg+Dw@mail.gmail.com Signed-off-by: Jan Kara --- fs/udf/dir.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) - I plan to merge this fix through my tree diff --git a/fs/udf/dir.c b/fs/udf/dir.c index 425e3c162935..12869b19acfa 100644 --- a/fs/udf/dir.c +++ b/fs/udf/dir.c @@ -115,10 +115,8 @@ static int udf_readdir(struct file *file, struct dir_context *ctx) goto out_iter; } - if (!ret) { + if (pos_valid) ctx->pos = (iter.pos >> 2) + 1; - pos_valid = true; - } out_iter: udf_fiiter_release(&iter); out: -- 2.53.0