Commit 2d863611 authored by Jeongjun Park's avatar Jeongjun Park Committed by Namjae Jeon
Browse files

exfat: fix out-of-bounds in exfat_nls_to_ucs2() 



Since the len argument value passed to exfat_ioctl_set_volume_label()
from exfat_nls_to_utf16() is passed 1 too large, an out-of-bounds read
occurs when dereferencing p_cstring in exfat_nls_to_ucs2() later.

And because of the NLS_NAME_OVERLEN macro, another error occurs when
creating a file with a period at the end using utf8 and other iocharsets.

So to avoid this, you should remove the code that uses NLS_NAME_OVERLEN
macro and make the len argument value be the length of the label string,
but with a maximum length of FSLABEL_MAX - 1.

Reported-by: default avatar <syzbot+98cc76a76de46b3714d4@syzkaller.appspotmail.com>
Closes: https://syzkaller.appspot.com/bug?extid=98cc76a76de46b3714d4


Fixes: d01579d5 ("exfat: Add support for FS_IOC_{GET,SET}FSLABEL")
Suggested-by: default avatarPali Rohár <pali@kernel.org>
Signed-off-by: default avatarJeongjun Park <aha310510@gmail.com>
Signed-off-by: default avatarNamjae Jeon <linkinjeon@kernel.org>
parent 82ebecdc

fs/exfat/exfat_fs.h

+0 −1
Original line number Diff line number Diff line
@@ -29,7 +29,6 @@ enum exfat_error_mode { 
enum {

	NLS_NAME_NO_LOSSY =	0,	/* no lossy */

	NLS_NAME_LOSSY =	1 << 0,	/* just detected incorrect filename(s) */

	NLS_NAME_OVERLEN =	1 << 1,	/* the length is over than its limit */

};



#define EXFAT_HASH_BITS		8

fs/exfat/file.c

+4 −3
Original line number Diff line number Diff line
@@ -509,8 +509,8 @@ static int exfat_ioctl_get_volume_label(struct super_block *sb, unsigned long ar 
static int exfat_ioctl_set_volume_label(struct super_block *sb,

					unsigned long arg)

{

	int ret = 0, lossy;

	char label[FSLABEL_MAX];

	int ret = 0, lossy, label_len;

	char label[FSLABEL_MAX] = {0};

	struct exfat_uni_name uniname;



	if (!capable(CAP_SYS_ADMIN))
@@ -520,8 +520,9 @@ static int exfat_ioctl_set_volume_label(struct super_block *sb, 
		return -EFAULT;



	memset(&uniname, 0, sizeof(uniname));

	label_len = strnlen(label, FSLABEL_MAX - 1);

	if (label[0]) {

		ret = exfat_nls_to_utf16(sb, label, FSLABEL_MAX,

		ret = exfat_nls_to_utf16(sb, label, label_len,

					 &uniname, &lossy);

		if (ret < 0)

			return ret;

fs/exfat/namei.c

+1 −1
Original line number Diff line number Diff line
@@ -442,7 +442,7 @@ static int __exfat_resolve_path(struct inode *inode, const unsigned char *path, 
		return namelen; /* return error value */



	if ((lossy && !lookup) || !namelen)

		return (lossy & NLS_NAME_OVERLEN) ? -ENAMETOOLONG : -EINVAL;

		return -EINVAL;



	return 0;

}

fs/exfat/nls.c

+0 −3
Original line number Diff line number Diff line
@@ -616,9 +616,6 @@ static int exfat_nls_to_ucs2(struct super_block *sb, 
		unilen++;

	}



	if (p_cstring[i] != '\0')

		lossy |= NLS_NAME_OVERLEN;



	*uniname = '\0';

	p_uniname->name_len = unilen;

	p_uniname->name_hash = exfat_calc_chksum16(upname, unilen << 1, 0,