From: Namjae Jeon <linkinjeon@kernel.org>
To: Jaehun Gou <p22gone@gmail.com>
Cc: linux-fsdevel@vger.kernel.org, linux-kernel@vger.kernel.org,
Seunghun Han <kkamagui@gmail.com>,
Jihoon Kwon <jimmyxyz010315@gmail.com>
Subject: Re: [PATCH] fs: exfat: fix improper check of dentry.stream.valid_size
Date: Wed, 15 Oct 2025 14:39:42 +0900 [thread overview]
Message-ID: <CAKYAXd-OSYg3fVoxDKVQm6r2kQDJuR-UfL26_ijoCPMsxX=L8Q@mail.gmail.com> (raw)
In-Reply-To: <20251014130146.3948175-1-p22gone@gmail.com>
On Tue, Oct 14, 2025 at 10:02 PM Jaehun Gou <p22gone@gmail.com> wrote:
>
> We found an infinite loop bug in the exFAT file system that can lead to a
> Denial-of-Service (DoS) condition. When a dentry in an exFAT filesystem is
> malformed, the following system calls — SYS_openat, SYS_ftruncate, and
> SYS_pwrite64 — can cause the kernel to hang.
>
> Root cause analysis shows that the size validation code in exfat_find()
> does not check whether dentry.stream.valid_size is negative. As a result,
> the system calls mentioned above can succeed and eventually trigger the DoS
> issue.
>
> This patch adds a check for negative dentry.stream.valid_size to prevent
> this vulnerability.
>
> Co-developed-by: Seunghun Han <kkamagui@gmail.com>
> Signed-off-by: Seunghun Han <kkamagui@gmail.com>
> Co-developed-by: Jihoon Kwon <jimmyxyz010315@gmail.com>
> Signed-off-by: Jihoon Kwon <jimmyxyz010315@gmail.com>
> Signed-off-by: Jaehun Gou <p22gone@gmail.com>
Applied it to #dev.
Thanks!
prev parent reply other threads:[~2025-10-15 5:39 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2025-10-14 13:01 [PATCH] fs: exfat: fix improper check of dentry.stream.valid_size Jaehun Gou
2025-10-15 5:39 ` Namjae Jeon [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to='CAKYAXd-OSYg3fVoxDKVQm6r2kQDJuR-UfL26_ijoCPMsxX=L8Q@mail.gmail.com' \
--to=linkinjeon@kernel.org \
--cc=jimmyxyz010315@gmail.com \
--cc=kkamagui@gmail.com \
--cc=linux-fsdevel@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=p22gone@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).