Commit a5324b3a authored by Yuezhang Mo's avatar Yuezhang Mo Committed by Namjae Jeon
Browse files

exfat: fix the infinite loop in __exfat_free_cluster() 



In __exfat_free_cluster(), the cluster chain is traversed until the
EOF cluster. If the cluster chain includes a loop due to file system
corruption, the EOF cluster cannot be traversed, resulting in an
infinite loop.

This commit uses the total number of clusters to prevent this infinite
loop.

Reported-by: default avatar <syzbot+1de5a37cb85a2d536330@syzkaller.appspotmail.com>
Closes: https://syzkaller.appspot.com/bug?extid=1de5a37cb85a2d536330


Tested-by: default avatar <syzbot+1de5a37cb85a2d536330@syzkaller.appspotmail.com>
Fixes: 31023864 ("exfat: add fat entry operations")
Signed-off-by: default avatarYuezhang Mo <Yuezhang.Mo@sony.com>
Reviewed-by: default avatarSungjong Seo <sj1557.seo@samsung.com>
Signed-off-by: default avatarNamjae Jeon <linkinjeon@kernel.org>
parent 98e2fb26

fs/exfat/fatent.c

+10 −0
Original line number Diff line number Diff line
@@ -216,6 +216,16 @@ static int __exfat_free_cluster(struct inode *inode, struct exfat_chain *p_chain 


			if (err)

				goto dec_used_clus;



			if (num_clusters >= sbi->num_clusters - EXFAT_FIRST_CLUSTER) {

				/*

				 * The cluster chain includes a loop, scan the

				 * bitmap to get the number of used clusters.

				 */

				exfat_count_used_clusters(sb, &sbi->used_clusters);



				return 0;

			}

		} while (clu != EXFAT_EOF_CLUSTER);

	}