* [PATCH v2] exfat: fix shift-out-of-bounds in exfat_fill_super() [not found] <CGME20210201025358epcas1p46c6943424d296e8ba46b361d637d0068@epcas1p4.samsung.com> @ 2021-02-01 2:46 ` Namjae Jeon 2021-02-01 4:13 ` Randy Dunlap 0 siblings, 1 reply; 3+ messages in thread From: Namjae Jeon @ 2021-02-01 2:46 UTC (permalink / raw) To: linux-fsdevel; +Cc: rdunlap, sj1557.seo, Namjae Jeon, stable syzbot reported a warning which could cause shift-out-of-bounds issue. Call Trace: __dump_stack lib/dump_stack.c:79 [inline] dump_stack+0x183/0x22e lib/dump_stack.c:120 ubsan_epilogue lib/ubsan.c:148 [inline] __ubsan_handle_shift_out_of_bounds+0x432/0x4d0 lib/ubsan.c:395 exfat_read_boot_sector fs/exfat/super.c:471 [inline] __exfat_fill_super fs/exfat/super.c:556 [inline] exfat_fill_super+0x2acb/0x2d00 fs/exfat/super.c:624 get_tree_bdev+0x406/0x630 fs/super.c:1291 vfs_get_tree+0x86/0x270 fs/super.c:1496 do_new_mount fs/namespace.c:2881 [inline] path_mount+0x1937/0x2c50 fs/namespace.c:3211 do_mount fs/namespace.c:3224 [inline] __do_sys_mount fs/namespace.c:3432 [inline] __se_sys_mount+0x2f9/0x3b0 fs/namespace.c:3409 do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46 entry_SYSCALL_64_after_hwframe+0x44/0xa9 exfat specification describe sect_per_clus_bits field of boot sector could be at most 25 - sect_size_bits and at least 0. And sect_size_bits can also affect this calculation, It also needs validation. This patch add validation for sect_per_clus_bits and sect_size_bits field of boot sector. Fixes: 719c1e182916 ("exfat: add super block operations") Cc: stable@vger.kernel.org # v5.9+ Reported-by: syzbot+da4fe66aaadd3c2e2d1c@syzkaller.appspotmail.com Reviewed-by: Sungjong Seo <sj1557.seo@samsung.com> Tested-by: Randy Dunlap <rdunlap@infradead.org> Signed-off-by: Namjae Jeon <namjae.jeon@samsung.com> --- v2: - change at most sect_per_clus_bits from 16 to 25 - sect_size_bits. fs/exfat/exfat_raw.h | 4 ++++ fs/exfat/super.c | 31 ++++++++++++++++++++++++++----- 2 files changed, 30 insertions(+), 5 deletions(-) diff --git a/fs/exfat/exfat_raw.h b/fs/exfat/exfat_raw.h index 6aec6288e1f2..7f39b1c6469c 100644 --- a/fs/exfat/exfat_raw.h +++ b/fs/exfat/exfat_raw.h @@ -77,6 +77,10 @@ #define EXFAT_FILE_NAME_LEN 15 +#define EXFAT_MIN_SECT_SIZE_BITS 9 +#define EXFAT_MAX_SECT_SIZE_BITS 12 +#define EXFAT_MAX_SECT_PER_CLUS_BITS(x) (25 - (x)->sect_size_bits) + /* EXFAT: Main and Backup Boot Sector (512 bytes) */ struct boot_sector { __u8 jmp_boot[BOOTSEC_JUMP_BOOT_LEN]; diff --git a/fs/exfat/super.c b/fs/exfat/super.c index 87be5bfc31eb..c6d8d2e53486 100644 --- a/fs/exfat/super.c +++ b/fs/exfat/super.c @@ -381,8 +381,7 @@ static int exfat_calibrate_blocksize(struct super_block *sb, int logical_sect) { struct exfat_sb_info *sbi = EXFAT_SB(sb); - if (!is_power_of_2(logical_sect) || - logical_sect < 512 || logical_sect > 4096) { + if (!is_power_of_2(logical_sect)) { exfat_err(sb, "bogus logical sector size %u", logical_sect); return -EIO; } @@ -451,6 +450,25 @@ static int exfat_read_boot_sector(struct super_block *sb) return -EINVAL; } + /* + * sect_size_bits could be at least 9 and at most 12. + */ + if (p_boot->sect_size_bits < EXFAT_MIN_SECT_SIZE_BITS || + p_boot->sect_size_bits > EXFAT_MAX_SECT_SIZE_BITS) { + exfat_err(sb, "bogus sector size bits : %u\n", + p_boot->sect_size_bits); + return -EINVAL; + } + + /* + * sect_per_clus_bits could be at least 0 and at most 25 - sect_size_bits. + */ + if (p_boot->sect_per_clus_bits > EXFAT_MAX_SECT_PER_CLUS_BITS(p_boot)) { + exfat_err(sb, "bogus sectors bits per cluster : %u\n", + p_boot->sect_per_clus_bits); + return -EINVAL; + } + sbi->sect_per_clus = 1 << p_boot->sect_per_clus_bits; sbi->sect_per_clus_bits = p_boot->sect_per_clus_bits; sbi->cluster_size_bits = p_boot->sect_per_clus_bits + @@ -477,16 +495,19 @@ static int exfat_read_boot_sector(struct super_block *sb) sbi->used_clusters = EXFAT_CLUSTERS_UNTRACKED; /* check consistencies */ - if (sbi->num_FAT_sectors << p_boot->sect_size_bits < - sbi->num_clusters * 4) { + if ((u64)sbi->num_FAT_sectors << p_boot->sect_size_bits < + (u64)sbi->num_clusters * 4) { exfat_err(sb, "bogus fat length"); return -EINVAL; } + if (sbi->data_start_sector < - sbi->FAT1_start_sector + sbi->num_FAT_sectors * p_boot->num_fats) { + (u64)sbi->FAT1_start_sector + + (u64)sbi->num_FAT_sectors * p_boot->num_fats) { exfat_err(sb, "bogus data start sector"); return -EINVAL; } + if (sbi->vol_flags & VOLUME_DIRTY) exfat_warn(sb, "Volume was not properly unmounted. Some data may be corrupt. Please run fsck."); if (sbi->vol_flags & MEDIA_FAILURE) -- 2.17.1 ^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH v2] exfat: fix shift-out-of-bounds in exfat_fill_super() 2021-02-01 2:46 ` [PATCH v2] exfat: fix shift-out-of-bounds in exfat_fill_super() Namjae Jeon @ 2021-02-01 4:13 ` Randy Dunlap 2021-02-01 4:24 ` Namjae Jeon 0 siblings, 1 reply; 3+ messages in thread From: Randy Dunlap @ 2021-02-01 4:13 UTC (permalink / raw) To: Namjae Jeon, linux-fsdevel; +Cc: sj1557.seo, stable On 1/31/21 6:46 PM, Namjae Jeon wrote: > syzbot reported a warning which could cause shift-out-of-bounds issue. > > Call Trace: > __dump_stack lib/dump_stack.c:79 [inline] > dump_stack+0x183/0x22e lib/dump_stack.c:120 > ubsan_epilogue lib/ubsan.c:148 [inline] > __ubsan_handle_shift_out_of_bounds+0x432/0x4d0 lib/ubsan.c:395 > exfat_read_boot_sector fs/exfat/super.c:471 [inline] > __exfat_fill_super fs/exfat/super.c:556 [inline] > exfat_fill_super+0x2acb/0x2d00 fs/exfat/super.c:624 > get_tree_bdev+0x406/0x630 fs/super.c:1291 > vfs_get_tree+0x86/0x270 fs/super.c:1496 > do_new_mount fs/namespace.c:2881 [inline] > path_mount+0x1937/0x2c50 fs/namespace.c:3211 > do_mount fs/namespace.c:3224 [inline] > __do_sys_mount fs/namespace.c:3432 [inline] > __se_sys_mount+0x2f9/0x3b0 fs/namespace.c:3409 > do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46 > entry_SYSCALL_64_after_hwframe+0x44/0xa9 > > exfat specification describe sect_per_clus_bits field of boot sector > could be at most 25 - sect_size_bits and at least 0. And sect_size_bits > can also affect this calculation, It also needs validation. > This patch add validation for sect_per_clus_bits and sect_size_bits > field of boot sector. > > Fixes: 719c1e182916 ("exfat: add super block operations") > Cc: stable@vger.kernel.org # v5.9+ > Reported-by: syzbot+da4fe66aaadd3c2e2d1c@syzkaller.appspotmail.com > Reviewed-by: Sungjong Seo <sj1557.seo@samsung.com> > Tested-by: Randy Dunlap <rdunlap@infradead.org> > Signed-off-by: Namjae Jeon <namjae.jeon@samsung.com> Tested-by: Randy Dunlap <rdunlap@infradead.org> # for v2 > --- > v2: > - change at most sect_per_clus_bits from 16 to 25 - sect_size_bits. > > fs/exfat/exfat_raw.h | 4 ++++ > fs/exfat/super.c | 31 ++++++++++++++++++++++++++----- > 2 files changed, 30 insertions(+), 5 deletions(-) thanks. -- ~Randy ^ permalink raw reply [flat|nested] 3+ messages in thread
* RE: [PATCH v2] exfat: fix shift-out-of-bounds in exfat_fill_super() 2021-02-01 4:13 ` Randy Dunlap @ 2021-02-01 4:24 ` Namjae Jeon 0 siblings, 0 replies; 3+ messages in thread From: Namjae Jeon @ 2021-02-01 4:24 UTC (permalink / raw) To: 'Randy Dunlap', linux-fsdevel; +Cc: sj1557.seo, stable > On 1/31/21 6:46 PM, Namjae Jeon wrote: > > syzbot reported a warning which could cause shift-out-of-bounds issue. > > > > Call Trace: > > __dump_stack lib/dump_stack.c:79 [inline] dump_stack+0x183/0x22e > > lib/dump_stack.c:120 ubsan_epilogue lib/ubsan.c:148 [inline] > > __ubsan_handle_shift_out_of_bounds+0x432/0x4d0 lib/ubsan.c:395 > > exfat_read_boot_sector fs/exfat/super.c:471 [inline] > > __exfat_fill_super fs/exfat/super.c:556 [inline] > > exfat_fill_super+0x2acb/0x2d00 fs/exfat/super.c:624 > > get_tree_bdev+0x406/0x630 fs/super.c:1291 > > vfs_get_tree+0x86/0x270 fs/super.c:1496 do_new_mount > > fs/namespace.c:2881 [inline] > > path_mount+0x1937/0x2c50 fs/namespace.c:3211 do_mount > > fs/namespace.c:3224 [inline] __do_sys_mount fs/namespace.c:3432 > > [inline] > > __se_sys_mount+0x2f9/0x3b0 fs/namespace.c:3409 > > do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46 > > entry_SYSCALL_64_after_hwframe+0x44/0xa9 > > > > exfat specification describe sect_per_clus_bits field of boot sector > > could be at most 25 - sect_size_bits and at least 0. And > > sect_size_bits can also affect this calculation, It also needs validation. > > This patch add validation for sect_per_clus_bits and sect_size_bits > > field of boot sector. > > > > Fixes: 719c1e182916 ("exfat: add super block operations") > > Cc: stable@vger.kernel.org # v5.9+ > > Reported-by: syzbot+da4fe66aaadd3c2e2d1c@syzkaller.appspotmail.com > > Reviewed-by: Sungjong Seo <sj1557.seo@samsung.com> > > Tested-by: Randy Dunlap <rdunlap@infradead.org> > > Signed-off-by: Namjae Jeon <namjae.jeon@samsung.com> > > Tested-by: Randy Dunlap <rdunlap@infradead.org> # for v2 Thanks for your testing! > > > > --- > > v2: > > - change at most sect_per_clus_bits from 16 to 25 - sect_size_bits. > > > > fs/exfat/exfat_raw.h | 4 ++++ > > fs/exfat/super.c | 31 ++++++++++++++++++++++++++----- > > 2 files changed, 30 insertions(+), 5 deletions(-) > > thanks. > -- > ~Randy ^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2021-02-01 4:25 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
[not found] <CGME20210201025358epcas1p46c6943424d296e8ba46b361d637d0068@epcas1p4.samsung.com>
2021-02-01 2:46 ` [PATCH v2] exfat: fix shift-out-of-bounds in exfat_fill_super() Namjae Jeon
2021-02-01 4:13 ` Randy Dunlap
2021-02-01 4:24 ` Namjae Jeon
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox; as well as URLs for NNTP newsgroup(s).