AFFS fix for 7.1

Hi,

please pull an AFFS fix. There's a potential out-of-bounds read in the directory hash table during readdir.

Thanks.

----------------------------------------------------------------
The following changes since commit c369299895a591d96745d6492d4888259b004a9e:

Linux 7.0-rc5 (2026-03-22 14:42:17 -0700)

are available in the Git repository at:

git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux.git tags/affs-for-7.1-tag

for you to fetch changes up to 6fa253b38b9b293a0de2a361de400557ca7666ca:

affs: bound hash_pos before table lookup in affs_readdir (2026-04-10 02:51:05 +0200)

----------------------------------------------------------------
Hyungjung Joo (1):
affs: bound hash_pos before table lookup in affs_readdir

 fs/affs/dir.c | 2 ++
 1 file changed, 2 insertions(+)

From: Hyungjung Joo <[email protected]>

affs_readdir() decodes ctx->pos into hash_pos and chain_pos and then dereferences AFFS_HEAD(dir_bh)->table[hash_pos] before validating that hash_pos is within the runtime table bound. Treat out-of-range positions as end-of-directory before the first table lookup.

---
 fs/affs/dir.c | 2 ++
 1 file changed, 2 insertions(+)

index 5c8d83387a39..075c18c4ccde 100644
@@ -119,6 +119,8 @@ affs_readdir(struct file *file, struct dir_context *ctx)
 		pr_debug("readdir() left off=%d\n", ino);
 		goto inside;
 	}
+	if (hash_pos >= AFFS_SB(sb)->s_hashsize)
+		goto done;
 
 	ino = be32_to_cpu(AFFS_HEAD(dir_bh)->table[hash_pos]);
 	for (i = 0; ino && i < chain_pos; i++) {

2.51.0