From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id D6FD0EE49AA for ; Sat, 19 Aug 2023 07:54:53 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1344563AbjHSHyV (ORCPT ); Sat, 19 Aug 2023 03:54:21 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:44862 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1344539AbjHSHyC (ORCPT ); Sat, 19 Aug 2023 03:54:02 -0400 Received: from mx0a-00069f02.pphosted.com (mx0a-00069f02.pphosted.com [205.220.165.32]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id F418A3C06; Sat, 19 Aug 2023 00:54:00 -0700 (PDT) Received: from pps.filterd (m0333521.ppops.net [127.0.0.1]) by mx0b-00069f02.pphosted.com (8.17.1.19/8.17.1.19) with ESMTP id 37J39Dw2032654; Sat, 19 Aug 2023 07:53:48 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.com; h=from : to : cc : subject : date : message-id : mime-version : content-transfer-encoding; s=corp-2023-03-30; bh=nTI8vH3S3FyfDJPkWLfcUdyZ5ckJ1JuWlZCVWTgr0c8=; b=yNT1/V5kRDtgJTPv/xIpC5if6lEUUMxNKfPMEeGTDhH+if5646Y3LNKI+USP9HA4H6V6 uaFi6XymTc5y5o4eehPtMw4w1O5o7Pa/Qc9irqmCRu4l4BOEKoMCwGOTO01O2vtJb1u8 kT5vJoZCeyqe7YFr8O6dyMB7LeGlWCja6EzKFZZq/fFvYTIVzhNAirLFuAqutxXMXAdr f/3wNUNEINNobQ6u4pUsi9Lca4NaReGwBR+Yx/3UZ5jG/mb8jRXsw08TXNiidS6pwqBr MGpoMCxTdIFWNP7GSABxb4XoJ5rq/5jkTbbLhOwy+Jr3NRLwUM8GaXiOscJg11zDy5B5 gw== Received: from iadpaimrmta01.imrmtpd1.prodappiadaev1.oraclevcn.com (iadpaimrmta01.appoci.oracle.com [130.35.100.223]) by mx0b-00069f02.pphosted.com (PPS) with ESMTPS id 3sjmnc0905-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Sat, 19 Aug 2023 07:53:47 +0000 Received: from pps.filterd (iadpaimrmta01.imrmtpd1.prodappiadaev1.oraclevcn.com [127.0.0.1]) by iadpaimrmta01.imrmtpd1.prodappiadaev1.oraclevcn.com (8.17.1.19/8.17.1.19) with ESMTP id 37J7Al7i029822; Sat, 19 Aug 2023 07:53:46 GMT Received: from pps.reinject (localhost [127.0.0.1]) by iadpaimrmta01.imrmtpd1.prodappiadaev1.oraclevcn.com (PPS) with ESMTPS id 3sjm686xyh-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Sat, 19 Aug 2023 07:53:46 +0000 Received: from iadpaimrmta01.imrmtpd1.prodappiadaev1.oraclevcn.com (iadpaimrmta01.imrmtpd1.prodappiadaev1.oraclevcn.com [127.0.0.1]) by pps.reinject (8.17.1.5/8.17.1.5) with ESMTP id 37J7rj5r001073; Sat, 19 Aug 2023 07:53:45 GMT Received: from ca-dev112.us.oracle.com (ca-dev112.us.oracle.com [10.129.136.47]) by iadpaimrmta01.imrmtpd1.prodappiadaev1.oraclevcn.com (PPS) with ESMTP id 3sjm686xyc-1; Sat, 19 Aug 2023 07:53:45 +0000 From: Harshit Mogalapalli To: stable@vger.kernel.org Cc: vegard.nossum@oracle.com, Namjae Jeon , Yuezhang Mo , Maxim Suhanov , Sungjong Seo , Sasha Levin , Harshit Mogalapalli , linux-fsdevel@vger.kernel.org, linux-kernel@vger.kernel.org Subject: [PATCH 5.15.y] exfat: check if filename entries exceeds max filename length Date: Sat, 19 Aug 2023 00:53:37 -0700 Message-ID: <20230819075337.3270182-1-harshit.m.mogalapalli@oracle.com> X-Mailer: git-send-email 2.41.0 MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.267,Aquarius:18.0.957,Hydra:6.0.601,FMLib:17.11.176.26 definitions=2023-08-19_06,2023-08-18_01,2023-05-22_02 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 spamscore=0 phishscore=0 suspectscore=0 bulkscore=0 malwarescore=0 mlxscore=0 adultscore=0 mlxlogscore=999 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2306200000 definitions=main-2308190073 X-Proofpoint-GUID: soWY6qcE-5vd3d2QtAZKDXD8gjoZaaV3 X-Proofpoint-ORIG-GUID: soWY6qcE-5vd3d2QtAZKDXD8gjoZaaV3 Precedence: bulk List-ID: X-Mailing-List: linux-fsdevel@vger.kernel.org From: Namjae Jeon [ Upstream commit d42334578eba1390859012ebb91e1e556d51db49 ] exfat_extract_uni_name copies characters from a given file name entry into the 'uniname' variable. This variable is actually defined on the stack of the exfat_readdir() function. According to the definition of the 'exfat_uni_name' type, the file name should be limited 255 characters (+ null teminator space), but the exfat_get_uniname_from_ext_entry() function can write more characters because there is no check if filename entries exceeds max filename length. This patch add the check not to copy filename characters when exceeding max filename length. Cc: stable@vger.kernel.org Cc: Yuezhang Mo Reported-by: Maxim Suhanov Reviewed-by: Sungjong Seo Signed-off-by: Namjae Jeon Signed-off-by: Sasha Levin [Harshit: backport to 5.15.y] Signed-off-by: Harshit Mogalapalli --- The conflict resolved patch for 6.1.y applies cleanly to 5.15.y as well. Note: This fix is already present in 5.10.y but missing in 5.15.y --- fs/exfat/dir.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/fs/exfat/dir.c b/fs/exfat/dir.c index 8475a8653c3a..f6dd4fc8eaf4 100644 --- a/fs/exfat/dir.c +++ b/fs/exfat/dir.c @@ -34,6 +34,7 @@ static void exfat_get_uniname_from_ext_entry(struct super_block *sb, { int i; struct exfat_entry_set_cache *es; + unsigned int uni_len = 0, len; es = exfat_get_dentry_set(sb, p_dir, entry, ES_ALL_ENTRIES); if (!es) @@ -52,7 +53,10 @@ static void exfat_get_uniname_from_ext_entry(struct super_block *sb, if (exfat_get_entry_type(ep) != TYPE_EXTEND) break; - exfat_extract_uni_name(ep, uniname); + len = exfat_extract_uni_name(ep, uniname); + uni_len += len; + if (len != EXFAT_FILE_NAME_LEN || uni_len >= MAX_NAME_LENGTH) + break; uniname += EXFAT_FILE_NAME_LEN; } @@ -1032,7 +1036,8 @@ int exfat_find_dir_entry(struct super_block *sb, struct exfat_inode_info *ei, if (entry_type == TYPE_EXTEND) { unsigned short entry_uniname[16], unichar; - if (step != DIRENT_STEP_NAME) { + if (step != DIRENT_STEP_NAME || + name_len >= MAX_NAME_LENGTH) { step = DIRENT_STEP_FILE; continue; } -- 2.34.1