All of lore.kernel.org
 help / color / mirror / Atom feed
* [PATCH v2] exfat: fix shift-out-of-bounds in exfat_fill_super()
       [not found] <CGME20210201025358epcas1p46c6943424d296e8ba46b361d637d0068@epcas1p4.samsung.com>
@ 2021-02-01  2:46 ` Namjae Jeon
  2021-02-01  4:13   ` Randy Dunlap
  0 siblings, 1 reply; 3+ messages in thread
From: Namjae Jeon @ 2021-02-01  2:46 UTC (permalink / raw)
  To: linux-fsdevel; +Cc: rdunlap, sj1557.seo, Namjae Jeon, stable

syzbot reported a warning which could cause shift-out-of-bounds issue.

Call Trace:
 __dump_stack lib/dump_stack.c:79 [inline]
 dump_stack+0x183/0x22e lib/dump_stack.c:120
 ubsan_epilogue lib/ubsan.c:148 [inline]
 __ubsan_handle_shift_out_of_bounds+0x432/0x4d0 lib/ubsan.c:395
 exfat_read_boot_sector fs/exfat/super.c:471 [inline]
 __exfat_fill_super fs/exfat/super.c:556 [inline]
 exfat_fill_super+0x2acb/0x2d00 fs/exfat/super.c:624
 get_tree_bdev+0x406/0x630 fs/super.c:1291
 vfs_get_tree+0x86/0x270 fs/super.c:1496
 do_new_mount fs/namespace.c:2881 [inline]
 path_mount+0x1937/0x2c50 fs/namespace.c:3211
 do_mount fs/namespace.c:3224 [inline]
 __do_sys_mount fs/namespace.c:3432 [inline]
 __se_sys_mount+0x2f9/0x3b0 fs/namespace.c:3409
 do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
 entry_SYSCALL_64_after_hwframe+0x44/0xa9

exfat specification describe sect_per_clus_bits field of boot sector
could be at most 25 - sect_size_bits and at least 0. And sect_size_bits
can also affect this calculation, It also needs validation.
This patch add validation for sect_per_clus_bits and sect_size_bits
field of boot sector.

Fixes: 719c1e182916 ("exfat: add super block operations")
Cc: stable@vger.kernel.org # v5.9+
Reported-by: syzbot+da4fe66aaadd3c2e2d1c@syzkaller.appspotmail.com
Reviewed-by: Sungjong Seo <sj1557.seo@samsung.com>
Tested-by: Randy Dunlap <rdunlap@infradead.org>
Signed-off-by: Namjae Jeon <namjae.jeon@samsung.com>
---
v2:
 - change at most sect_per_clus_bits from 16 to 25 - sect_size_bits.

 fs/exfat/exfat_raw.h |  4 ++++
 fs/exfat/super.c     | 31 ++++++++++++++++++++++++++-----
 2 files changed, 30 insertions(+), 5 deletions(-)

diff --git a/fs/exfat/exfat_raw.h b/fs/exfat/exfat_raw.h
index 6aec6288e1f2..7f39b1c6469c 100644
--- a/fs/exfat/exfat_raw.h
+++ b/fs/exfat/exfat_raw.h
@@ -77,6 +77,10 @@
 
 #define EXFAT_FILE_NAME_LEN		15
 
+#define EXFAT_MIN_SECT_SIZE_BITS		9
+#define EXFAT_MAX_SECT_SIZE_BITS		12
+#define EXFAT_MAX_SECT_PER_CLUS_BITS(x)		(25 - (x)->sect_size_bits)
+
 /* EXFAT: Main and Backup Boot Sector (512 bytes) */
 struct boot_sector {
 	__u8	jmp_boot[BOOTSEC_JUMP_BOOT_LEN];
diff --git a/fs/exfat/super.c b/fs/exfat/super.c
index 87be5bfc31eb..c6d8d2e53486 100644
--- a/fs/exfat/super.c
+++ b/fs/exfat/super.c
@@ -381,8 +381,7 @@ static int exfat_calibrate_blocksize(struct super_block *sb, int logical_sect)
 {
 	struct exfat_sb_info *sbi = EXFAT_SB(sb);
 
-	if (!is_power_of_2(logical_sect) ||
-	    logical_sect < 512 || logical_sect > 4096) {
+	if (!is_power_of_2(logical_sect)) {
 		exfat_err(sb, "bogus logical sector size %u", logical_sect);
 		return -EIO;
 	}
@@ -451,6 +450,25 @@ static int exfat_read_boot_sector(struct super_block *sb)
 		return -EINVAL;
 	}
 
+	/*
+	 * sect_size_bits could be at least 9 and at most 12.
+	 */
+	if (p_boot->sect_size_bits < EXFAT_MIN_SECT_SIZE_BITS ||
+	    p_boot->sect_size_bits > EXFAT_MAX_SECT_SIZE_BITS) {
+		exfat_err(sb, "bogus sector size bits : %u\n",
+				p_boot->sect_size_bits);
+		return -EINVAL;
+	}
+
+	/*
+	 * sect_per_clus_bits could be at least 0 and at most 25 - sect_size_bits.
+	 */
+	if (p_boot->sect_per_clus_bits > EXFAT_MAX_SECT_PER_CLUS_BITS(p_boot)) {
+		exfat_err(sb, "bogus sectors bits per cluster : %u\n",
+				p_boot->sect_per_clus_bits);
+		return -EINVAL;
+	}
+
 	sbi->sect_per_clus = 1 << p_boot->sect_per_clus_bits;
 	sbi->sect_per_clus_bits = p_boot->sect_per_clus_bits;
 	sbi->cluster_size_bits = p_boot->sect_per_clus_bits +
@@ -477,16 +495,19 @@ static int exfat_read_boot_sector(struct super_block *sb)
 	sbi->used_clusters = EXFAT_CLUSTERS_UNTRACKED;
 
 	/* check consistencies */
-	if (sbi->num_FAT_sectors << p_boot->sect_size_bits <
-	    sbi->num_clusters * 4) {
+	if ((u64)sbi->num_FAT_sectors << p_boot->sect_size_bits <
+	    (u64)sbi->num_clusters * 4) {
 		exfat_err(sb, "bogus fat length");
 		return -EINVAL;
 	}
+
 	if (sbi->data_start_sector <
-	    sbi->FAT1_start_sector + sbi->num_FAT_sectors * p_boot->num_fats) {
+	    (u64)sbi->FAT1_start_sector +
+	    (u64)sbi->num_FAT_sectors * p_boot->num_fats) {
 		exfat_err(sb, "bogus data start sector");
 		return -EINVAL;
 	}
+
 	if (sbi->vol_flags & VOLUME_DIRTY)
 		exfat_warn(sb, "Volume was not properly unmounted. Some data may be corrupt. Please run fsck.");
 	if (sbi->vol_flags & MEDIA_FAILURE)
-- 
2.17.1


^ permalink raw reply related	[flat|nested] 3+ messages in thread

* Re: [PATCH v2] exfat: fix shift-out-of-bounds in exfat_fill_super()
  2021-02-01  2:46 ` [PATCH v2] exfat: fix shift-out-of-bounds in exfat_fill_super() Namjae Jeon
@ 2021-02-01  4:13   ` Randy Dunlap
  2021-02-01  4:24     ` Namjae Jeon
  0 siblings, 1 reply; 3+ messages in thread
From: Randy Dunlap @ 2021-02-01  4:13 UTC (permalink / raw)
  To: Namjae Jeon, linux-fsdevel; +Cc: sj1557.seo, stable

On 1/31/21 6:46 PM, Namjae Jeon wrote:
> syzbot reported a warning which could cause shift-out-of-bounds issue.
> 
> Call Trace:
>  __dump_stack lib/dump_stack.c:79 [inline]
>  dump_stack+0x183/0x22e lib/dump_stack.c:120
>  ubsan_epilogue lib/ubsan.c:148 [inline]
>  __ubsan_handle_shift_out_of_bounds+0x432/0x4d0 lib/ubsan.c:395
>  exfat_read_boot_sector fs/exfat/super.c:471 [inline]
>  __exfat_fill_super fs/exfat/super.c:556 [inline]
>  exfat_fill_super+0x2acb/0x2d00 fs/exfat/super.c:624
>  get_tree_bdev+0x406/0x630 fs/super.c:1291
>  vfs_get_tree+0x86/0x270 fs/super.c:1496
>  do_new_mount fs/namespace.c:2881 [inline]
>  path_mount+0x1937/0x2c50 fs/namespace.c:3211
>  do_mount fs/namespace.c:3224 [inline]
>  __do_sys_mount fs/namespace.c:3432 [inline]
>  __se_sys_mount+0x2f9/0x3b0 fs/namespace.c:3409
>  do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
>  entry_SYSCALL_64_after_hwframe+0x44/0xa9
> 
> exfat specification describe sect_per_clus_bits field of boot sector
> could be at most 25 - sect_size_bits and at least 0. And sect_size_bits
> can also affect this calculation, It also needs validation.
> This patch add validation for sect_per_clus_bits and sect_size_bits
> field of boot sector.
> 
> Fixes: 719c1e182916 ("exfat: add super block operations")
> Cc: stable@vger.kernel.org # v5.9+
> Reported-by: syzbot+da4fe66aaadd3c2e2d1c@syzkaller.appspotmail.com
> Reviewed-by: Sungjong Seo <sj1557.seo@samsung.com>
> Tested-by: Randy Dunlap <rdunlap@infradead.org>
> Signed-off-by: Namjae Jeon <namjae.jeon@samsung.com>

Tested-by: Randy Dunlap <rdunlap@infradead.org> # for v2


> ---
> v2:
>  - change at most sect_per_clus_bits from 16 to 25 - sect_size_bits.
> 
>  fs/exfat/exfat_raw.h |  4 ++++
>  fs/exfat/super.c     | 31 ++++++++++++++++++++++++++-----
>  2 files changed, 30 insertions(+), 5 deletions(-)

thanks.
-- 
~Randy


^ permalink raw reply	[flat|nested] 3+ messages in thread

* RE: [PATCH v2] exfat: fix shift-out-of-bounds in exfat_fill_super()
  2021-02-01  4:13   ` Randy Dunlap
@ 2021-02-01  4:24     ` Namjae Jeon
  0 siblings, 0 replies; 3+ messages in thread
From: Namjae Jeon @ 2021-02-01  4:24 UTC (permalink / raw)
  To: 'Randy Dunlap', linux-fsdevel; +Cc: sj1557.seo, stable

> On 1/31/21 6:46 PM, Namjae Jeon wrote:
> > syzbot reported a warning which could cause shift-out-of-bounds issue.
> >
> > Call Trace:
> >  __dump_stack lib/dump_stack.c:79 [inline]  dump_stack+0x183/0x22e
> > lib/dump_stack.c:120  ubsan_epilogue lib/ubsan.c:148 [inline]
> >  __ubsan_handle_shift_out_of_bounds+0x432/0x4d0 lib/ubsan.c:395
> > exfat_read_boot_sector fs/exfat/super.c:471 [inline]
> > __exfat_fill_super fs/exfat/super.c:556 [inline]
> >  exfat_fill_super+0x2acb/0x2d00 fs/exfat/super.c:624
> >  get_tree_bdev+0x406/0x630 fs/super.c:1291
> >  vfs_get_tree+0x86/0x270 fs/super.c:1496  do_new_mount
> > fs/namespace.c:2881 [inline]
> >  path_mount+0x1937/0x2c50 fs/namespace.c:3211  do_mount
> > fs/namespace.c:3224 [inline]  __do_sys_mount fs/namespace.c:3432
> > [inline]
> >  __se_sys_mount+0x2f9/0x3b0 fs/namespace.c:3409
> >  do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
> >  entry_SYSCALL_64_after_hwframe+0x44/0xa9
> >
> > exfat specification describe sect_per_clus_bits field of boot sector
> > could be at most 25 - sect_size_bits and at least 0. And
> > sect_size_bits can also affect this calculation, It also needs validation.
> > This patch add validation for sect_per_clus_bits and sect_size_bits
> > field of boot sector.
> >
> > Fixes: 719c1e182916 ("exfat: add super block operations")
> > Cc: stable@vger.kernel.org # v5.9+
> > Reported-by: syzbot+da4fe66aaadd3c2e2d1c@syzkaller.appspotmail.com
> > Reviewed-by: Sungjong Seo <sj1557.seo@samsung.com>
> > Tested-by: Randy Dunlap <rdunlap@infradead.org>
> > Signed-off-by: Namjae Jeon <namjae.jeon@samsung.com>
> 
> Tested-by: Randy Dunlap <rdunlap@infradead.org> # for v2
Thanks for your testing!
> 
> 
> > ---
> > v2:
> >  - change at most sect_per_clus_bits from 16 to 25 - sect_size_bits.
> >
> >  fs/exfat/exfat_raw.h |  4 ++++
> >  fs/exfat/super.c     | 31 ++++++++++++++++++++++++++-----
> >  2 files changed, 30 insertions(+), 5 deletions(-)
> 
> thanks.
> --
> ~Randy



^ permalink raw reply	[flat|nested] 3+ messages in thread

end of thread, other threads:[~2021-02-01  4:25 UTC | newest]

Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
     [not found] <CGME20210201025358epcas1p46c6943424d296e8ba46b361d637d0068@epcas1p4.samsung.com>
2021-02-01  2:46 ` [PATCH v2] exfat: fix shift-out-of-bounds in exfat_fill_super() Namjae Jeon
2021-02-01  4:13   ` Randy Dunlap
2021-02-01  4:24     ` Namjae Jeon

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.