On 1/28/21 11:12 PM, Namjae Jeon wrote:
> syzbot reported a warning which could cause shift-out-of-bounds issue.
>
> Call Trace:
> __dump_stack lib/dump_stack.c:79 [inline]
> dump_stack+0x183/0x22e lib/dump_stack.c:120
> ubsan_epilogue lib/ubsan.c:148 [inline]
> __ubsan_handle_shift_out_of_bounds+0x432/0x4d0 lib/ubsan.c:395
> exfat_read_boot_sector fs/exfat/super.c:471 [inline]
> __exfat_fill_super fs/exfat/super.c:556 [inline]
> exfat_fill_super+0x2acb/0x2d00 fs/exfat/super.c:624
> get_tree_bdev+0x406/0x630 fs/super.c:1291
> vfs_get_tree+0x86/0x270 fs/super.c:1496
> do_new_mount fs/namespace.c:2881 [inline]
> path_mount+0x1937/0x2c50 fs/namespace.c:3211
> do_mount fs/namespace.c:3224 [inline]
> __do_sys_mount fs/namespace.c:3432 [inline]
> __se_sys_mount+0x2f9/0x3b0 fs/namespace.c:3409
> do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
> entry_SYSCALL_64_after_hwframe+0x44/0xa9
>
> exfat specification describe sect_per_clus_bits field of boot sector
> could be at most 16 and at least 0. And sect_size_bits can also
> affect this calculation, It also needs validation.
> This patch add validation for sect_per_clus_bits and sect_size_bits
> field of boot sector.
>
> Fixes: 719c1e182916 ("exfat: add super block operations")
> Cc: stable@xxxxxxxxxxxxxxx # v5.9+
> Reported-by: syzbot+da4fe66aaadd3c2e2d1c@xxxxxxxxxxxxxxxxxxxxxxxxx
> Reviewed-by: Sungjong Seo <sj1557.seo@xxxxxxxxxxx>
> Signed-off-by: Namjae Jeon <namjae.jeon@xxxxxxxxxxx>
Tested-by: Randy Dunlap <rdunlap@xxxxxxxxxxxxx>
[ 172.721719] exFAT-fs (loop0): bogus sector size bits : 0
[ 172.721736] exFAT-fs (loop0): failed to read boot sector
[ 172.721744] exFAT-fs (loop0): failed to recognize exfat type
Thanks.
> ---
> fs/exfat/exfat_raw.h | 4 ++++
> fs/exfat/super.c | 31 ++++++++++++++++++++++++++-----
> 2 files changed, 30 insertions(+), 5 deletions(-)
--
~Randy
