Skip to content
  • Namjae Jeon's avatar
    78c276f5
    exfat: fix shift-out-of-bounds in exfat_fill_super() · 78c276f5
    Namjae Jeon authored
    
    
    syzbot reported a warning which could cause shift-out-of-bounds issue.
    
    Call Trace:
     __dump_stack lib/dump_stack.c:79 [inline]
     dump_stack+0x183/0x22e lib/dump_stack.c:120
     ubsan_epilogue lib/ubsan.c:148 [inline]
     __ubsan_handle_shift_out_of_bounds+0x432/0x4d0 lib/ubsan.c:395
     exfat_read_boot_sector fs/exfat/super.c:471 [inline]
     __exfat_fill_super fs/exfat/super.c:556 [inline]
     exfat_fill_super+0x2acb/0x2d00 fs/exfat/super.c:624
     get_tree_bdev+0x406/0x630 fs/super.c:1291
     vfs_get_tree+0x86/0x270 fs/super.c:1496
     do_new_mount fs/namespace.c:2881 [inline]
     path_mount+0x1937/0x2c50 fs/namespace.c:3211
     do_mount fs/namespace.c:3224 [inline]
     __do_sys_mount fs/namespace.c:3432 [inline]
     __se_sys_mount+0x2f9/0x3b0 fs/namespace.c:3409
     do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
     entry_SYSCALL_64_after_hwframe+0x44/0xa9
    
    exfat specification describe sect_per_clus_bits field of boot sector
    could be at most 25 - sect_size_bits and at least 0. And sect_size_bits
    can also affect this calculation, It also needs validation.
    This patch add validation for sect_per_clus_bits and sect_size_bits
    field of boot sector.
    
    Fixes: 719c1e18 ("exfat: add super block operations")
    Cc: stable@vger.kernel.org # v5.9+
    Reported-by: default avatar <syzbot+da4fe66aaadd3c2e2d1c@syzkaller.appspotmail.com>
    Reviewed-by: default avatarSungjong Seo <sj1557.seo@samsung.com>
    Tested-by: default avatarRandy Dunlap <rdunlap@infradead.org>
    Signed-off-by: default avatarNamjae Jeon <namjae.jeon@samsung.com>
    78c276f5
    exfat: fix shift-out-of-bounds in exfat_fill_super()
    Namjae Jeon authored
    
    
    syzbot reported a warning which could cause shift-out-of-bounds issue.
    
    Call Trace:
     __dump_stack lib/dump_stack.c:79 [inline]
     dump_stack+0x183/0x22e lib/dump_stack.c:120
     ubsan_epilogue lib/ubsan.c:148 [inline]
     __ubsan_handle_shift_out_of_bounds+0x432/0x4d0 lib/ubsan.c:395
     exfat_read_boot_sector fs/exfat/super.c:471 [inline]
     __exfat_fill_super fs/exfat/super.c:556 [inline]
     exfat_fill_super+0x2acb/0x2d00 fs/exfat/super.c:624
     get_tree_bdev+0x406/0x630 fs/super.c:1291
     vfs_get_tree+0x86/0x270 fs/super.c:1496
     do_new_mount fs/namespace.c:2881 [inline]
     path_mount+0x1937/0x2c50 fs/namespace.c:3211
     do_mount fs/namespace.c:3224 [inline]
     __do_sys_mount fs/namespace.c:3432 [inline]
     __se_sys_mount+0x2f9/0x3b0 fs/namespace.c:3409
     do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
     entry_SYSCALL_64_after_hwframe+0x44/0xa9
    
    exfat specification describe sect_per_clus_bits field of boot sector
    could be at most 25 - sect_size_bits and at least 0. And sect_size_bits
    can also affect this calculation, It also needs validation.
    This patch add validation for sect_per_clus_bits and sect_size_bits
    field of boot sector.
    
    Fixes: 719c1e18 ("exfat: add super block operations")
    Cc: stable@vger.kernel.org # v5.9+
    Reported-by: default avatar <syzbot+da4fe66aaadd3c2e2d1c@syzkaller.appspotmail.com>
    Reviewed-by: default avatarSungjong Seo <sj1557.seo@samsung.com>
    Tested-by: default avatarRandy Dunlap <rdunlap@infradead.org>
    Signed-off-by: default avatarNamjae Jeon <namjae.jeon@samsung.com>
Loading