RE: [PATCH v2] exfat: fix shift-out-of-bounds in exfat_fill_super()

["Namjae Jeon" <namjae.jeon@samsung.com>]

> On 1/31/21 6:46 PM, Namjae Jeon wrote:
> > syzbot reported a warning which could cause shift-out-of-bounds issue.
> >
> > Call Trace:
> >  __dump_stack lib/dump_stack.c:79 [inline]  dump_stack+0x183/0x22e
> > lib/dump_stack.c:120  ubsan_epilogue lib/ubsan.c:148 [inline]
> >  __ubsan_handle_shift_out_of_bounds+0x432/0x4d0 lib/ubsan.c:395
> > exfat_read_boot_sector fs/exfat/super.c:471 [inline]
> > __exfat_fill_super fs/exfat/super.c:556 [inline]
> >  exfat_fill_super+0x2acb/0x2d00 fs/exfat/super.c:624
> >  get_tree_bdev+0x406/0x630 fs/super.c:1291
> >  vfs_get_tree+0x86/0x270 fs/super.c:1496  do_new_mount
> > fs/namespace.c:2881 [inline]
> >  path_mount+0x1937/0x2c50 fs/namespace.c:3211  do_mount
> > fs/namespace.c:3224 [inline]  __do_sys_mount fs/namespace.c:3432
> > [inline]
> >  __se_sys_mount+0x2f9/0x3b0 fs/namespace.c:3409
> >  do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
> >  entry_SYSCALL_64_after_hwframe+0x44/0xa9
> >
> > exfat specification describe sect_per_clus_bits field of boot sector
> > could be at most 25 - sect_size_bits and at least 0. And
> > sect_size_bits can also affect this calculation, It also needs validation.
> > This patch add validation for sect_per_clus_bits and sect_size_bits
> > field of boot sector.
> >
> > Fixes: 719c1e182916 ("exfat: add super block operations")
> > Cc: stable@vger.kernel.org # v5.9+
> > Reported-by: syzbot+da4fe66aaadd3c2e2d1c@syzkaller.appspotmail.com
> > Reviewed-by: Sungjong Seo <sj1557.seo@samsung.com>
> > Tested-by: Randy Dunlap <rdunlap@infradead.org>
> > Signed-off-by: Namjae Jeon <namjae.jeon@samsung.com>
> 
> Tested-by: Randy Dunlap <rdunlap@infradead.org> # for v2
Thanks for your testing!
> 
> 
> > ---
> > v2:
> >  - change at most sect_per_clus_bits from 16 to 25 - sect_size_bits.
> >
> >  fs/exfat/exfat_raw.h |  4 ++++
> >  fs/exfat/super.c     | 31 ++++++++++++++++++++++++++-----
> >  2 files changed, 30 insertions(+), 5 deletions(-)
> 
> thanks.
> --
> ~Randy