Commit 847f242f authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge tag 'exfat-for-6.18-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/linkinjeon/exfat 

Pull exfat fixes from Namjae Jeon:

 - Fix out-of-bounds in FS_IOC_SETFSLABEL

 - Add validation for stream entry size to prevent infinite loop

* tag 'exfat-for-6.18-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/linkinjeon/exfat:
  exfat: fix out-of-bounds in exfat_nls_to_ucs2()
  exfat: fix improper check of dentry.stream.valid_size
parents 2d07c6c2 2d863611

fs/exfat/exfat_fs.h

+0 −1
Original line number Diff line number Diff line
@@ -29,7 +29,6 @@ enum exfat_error_mode { 
enum {

	NLS_NAME_NO_LOSSY =	0,	/* no lossy */

	NLS_NAME_LOSSY =	1 << 0,	/* just detected incorrect filename(s) */

	NLS_NAME_OVERLEN =	1 << 1,	/* the length is over than its limit */

};



#define EXFAT_HASH_BITS		8

fs/exfat/file.c

+4 −3
Original line number Diff line number Diff line
@@ -509,8 +509,8 @@ static int exfat_ioctl_get_volume_label(struct super_block *sb, unsigned long ar 
static int exfat_ioctl_set_volume_label(struct super_block *sb,

					unsigned long arg)

{

	int ret = 0, lossy;

	char label[FSLABEL_MAX];

	int ret = 0, lossy, label_len;

	char label[FSLABEL_MAX] = {0};

	struct exfat_uni_name uniname;



	if (!capable(CAP_SYS_ADMIN))
@@ -520,8 +520,9 @@ static int exfat_ioctl_set_volume_label(struct super_block *sb, 
		return -EFAULT;



	memset(&uniname, 0, sizeof(uniname));

	label_len = strnlen(label, FSLABEL_MAX - 1);

	if (label[0]) {

		ret = exfat_nls_to_utf16(sb, label, FSLABEL_MAX,

		ret = exfat_nls_to_utf16(sb, label, label_len,

					 &uniname, &lossy);

		if (ret < 0)

			return ret;

fs/exfat/namei.c

+6 −2
Original line number Diff line number Diff line
@@ -442,7 +442,7 @@ static int __exfat_resolve_path(struct inode *inode, const unsigned char *path, 
		return namelen; /* return error value */



	if ((lossy && !lookup) || !namelen)

		return (lossy & NLS_NAME_OVERLEN) ? -ENAMETOOLONG : -EINVAL;

		return -EINVAL;



	return 0;

}
@@ -642,10 +642,14 @@ static int exfat_find(struct inode *dir, const struct qstr *qname, 


	info->type = exfat_get_entry_type(ep);

	info->attr = le16_to_cpu(ep->dentry.file.attr);

	info->size = le64_to_cpu(ep2->dentry.stream.valid_size);

	info->valid_size = le64_to_cpu(ep2->dentry.stream.valid_size);

	info->size = le64_to_cpu(ep2->dentry.stream.size);



	if (info->valid_size < 0) {

		exfat_fs_error(sb, "data valid size is invalid(%lld)", info->valid_size);

		return -EIO;

	}



	if (unlikely(EXFAT_B_TO_CLU_ROUND_UP(info->size, sbi) > sbi->used_clusters)) {

		exfat_fs_error(sb, "data size is invalid(%lld)", info->size);

		return -EIO;

fs/exfat/nls.c

+0 −3
Original line number Diff line number Diff line
@@ -616,9 +616,6 @@ static int exfat_nls_to_ucs2(struct super_block *sb, 
		unilen++;

	}



	if (p_cstring[i] != '\0')

		lossy |= NLS_NAME_OVERLEN;



	*uniname = '\0';

	p_uniname->name_len = unilen;

	p_uniname->name_hash = exfat_calc_chksum16(upname, unilen << 1, 0,