[PATCH] more VFAT_IOCTL_READDIR_BOTH/_SHORT ioctl fixes (1/11)

    - check the ioctl cmd first
    - check the directory whether it's an already dead

diff --git a/fs/fat/dir.c b/fs/fat/dir.c
index d10571657ecb9e121ddf92330556c096c400563b..e68f0672343831e456a3636c5c99a9ff46c9227c 100644 (file)
--- a/fs/fat/dir.c
+++ b/fs/fat/dir.c
@@ -647,9 +647,23 @@ int fat_dir_ioctl(struct inode * inode, struct file * filp,
                  unsigned int cmd, unsigned long arg)
 {
        struct fat_ioctl_filldir_callback buf;
-       struct dirent __user *d1 = (struct dirent *)arg;
+       struct dirent __user *d1;
        int ret, shortname, both;
 
+       switch (cmd) {
+       case VFAT_IOCTL_READDIR_SHORT:
+               shortname = 1;
+               both = 1;
+               break;
+       case VFAT_IOCTL_READDIR_BOTH:
+               shortname = 0;
+               both = 1;
+               break;
+       default:
+               return -EINVAL;
+       }
+
+       d1 = (struct dirent *)arg;
        if (!access_ok(VERIFY_WRITE, d1, sizeof(struct dirent[2])))
                return -EFAULT;
        /*
@@ -662,20 +676,13 @@ int fat_dir_ioctl(struct inode * inode, struct file * filp,
 
        buf.dirent = d1;
        buf.result = 0;
-       switch (cmd) {
-       case VFAT_IOCTL_READDIR_SHORT:
-               shortname = 1;
-               both = 1;
-               break;
-       case VFAT_IOCTL_READDIR_BOTH:
-               shortname = 0;
-               both = 1;
-               break;
-       default:
-               return -EINVAL;
+       down(&inode->i_sem);
+       ret = -ENOENT;
+       if (!IS_DEADDIR(inode)) {
+               ret = fat_readdirx(inode, filp, &buf, fat_ioctl_filldir,
+                                  shortname, both);
        }
-       ret = fat_readdirx(inode, filp, &buf, fat_ioctl_filldir,
-                          shortname, both);
+       up(&inode->i_sem);
        if (ret >= 0)
                ret = buf.result;
        return ret;