[PATCH] omfs: fix use-after-free and inverted logic in omfs_dir_is_empty()

[Aamir Ahmed]

omfs_dir_is_empty() has three bugs:

1. Use-after-free: the function reads *ptr after brelse(bh) has released
   the buffer_head reference, accessing potentially freed memory.

2. Out-of-bounds read: when all directory hash buckets are empty (~0),
   the loop completes without breaking and ptr advances past the end of
   the bucket array. The subsequent *ptr dereference reads beyond the
   block buffer.

3. Inverted return value: the function returns (*ptr != ~0), which
   evaluates to 1 (true) when the directory has entries and 0 (false)
   when empty. Since the caller checks !omfs_dir_is_empty(), the
   inverted result means rmdir succeeds on non-empty directories and
   fails on empty ones.

Fix all three issues by saving the emptiness result in a local variable
before releasing the buffer, and inverting the sense so that the
function correctly returns 1 when the directory is empty and 0 when it
is not.

Fixes: a3ab7155ea21 ("omfs: add directory routines")
Cc: Bob Copeland <me@xxxxxxxxxxxxxxx>
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Aamir Ahmed <elb12345@xxxxxxxxxxxxx>
---
 fs/omfs/dir.c | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/fs/omfs/dir.c b/fs/omfs/dir.c
index 692297cf84e7..55b0a3ae8e59 100644
--- a/fs/omfs/dir.c
+++ b/fs/omfs/dir.c
@@ -219,6 +219,7 @@ static int omfs_dir_is_empty(struct inode *inode)
 	struct buffer_head *bh;
 	u64 *ptr;
 	int i;
+	int empty = 1;
 
 	bh = omfs_bread(inode->i_sb, inode->i_ino);
 
@@ -227,12 +228,15 @@ static int omfs_dir_is_empty(struct inode *inode)
 
 	ptr = (u64 *) &bh->b_data[OMFS_DIR_START];
 
-	for (i = 0; i < nbuckets; i++, ptr++)
-		if (*ptr != ~0)
+	for (i = 0; i < nbuckets; i++, ptr++) {
+		if (*ptr != ~0) {
+			empty = 0;
 			break;
+		}
+	}
 
 	brelse(bh);
-	return *ptr != ~0;
+	return empty;
 }
 
 static int omfs_remove(struct inode *dir, struct dentry *dentry)
-- 
2.43.0