[PATCH] exfat: Use str length when converting to utf16

[Edward Adam Davis <eadavis@qq.com>]

syz reported a stack-out-of-bounds Read in exfat_nls_to_ucs2. [1]

Although general ioctl supports label of FSLABEL_MAX chars, when operating
on label passed in by the user, we should use strnlen to obtain the actual
character length instead of FSLABEL_MAX.

[1]
BUG: KASAN: stack-out-of-bounds in exfat_nls_to_ucs2+0x706/0x730 fs/exfat/nls.c:619
Read of size 1 at addr ffffc9000383fcc8 by task syz.0.17/5984
Call Trace:
 exfat_nls_to_ucs2+0x706/0x730 fs/exfat/nls.c:619
 exfat_nls_to_utf16+0xa6/0xf0 fs/exfat/nls.c:647
 exfat_ioctl_set_volume_label+0x15d/0x230 fs/exfat/file.c:524

Fixes: d01579d590f7 ("exfat: Add support for FS_IOC_{GET,SET}FSLABEL")
Reported-by: syzbot+29934710e7fb9cb71f33@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=29934710e7fb9cb71f33
Tested-by: syzbot+29934710e7fb9cb71f33@syzkaller.appspotmail.com
Signed-off-by: Edward Adam Davis <eadavis@qq.com>
---
 fs/exfat/file.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/fs/exfat/file.c b/fs/exfat/file.c
index f246cf439588..c4001e1c289d 100644
--- a/fs/exfat/file.c
+++ b/fs/exfat/file.c
@@ -509,8 +509,8 @@ static int exfat_ioctl_get_volume_label(struct super_block *sb, unsigned long ar
 static int exfat_ioctl_set_volume_label(struct super_block *sb,
 					unsigned long arg)
 {
-	int ret = 0, lossy;
-	char label[FSLABEL_MAX];
+	int ret = 0, lossy, len;
+	char label[FSLABEL_MAX] = {0};
 	struct exfat_uni_name uniname;
 
 	if (!capable(CAP_SYS_ADMIN))
@@ -519,9 +519,10 @@ static int exfat_ioctl_set_volume_label(struct super_block *sb,
 	if (copy_from_user(label, (char __user *)arg, FSLABEL_MAX))
 		return -EFAULT;
 
+	len = strnlen(label, FSLABEL_MAX);
 	memset(&uniname, 0, sizeof(uniname));
 	if (label[0]) {
-		ret = exfat_nls_to_utf16(sb, label, FSLABEL_MAX,
+		ret = exfat_nls_to_utf16(sb, label, len,
 					 &uniname, &lossy);
 		if (ret < 0)
 			return ret;
-- 
2.43.0