git
/
linux
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Description for this pull request: 

- Fix out-of-bounds in FS_IOC_SETFSLABEL.
  - Add validation for stream entry valid size to prevent infinite loop.
 -----BEGIN PGP SIGNATURE-----
 
 iQJKBAABCgA0FiEE6NzKS6Uv/XAAGHgyZwv7A1FEIQgFAmjy83gWHGxpbmtpbmpl
 b25Aa2VybmVsLm9yZwAKCRBnC/sDUUQhCLoTD/sEUM1PpRJmSBRzH+9Le/tSAjK7
 M0MSLkryRvvFKdigCCtHD5LLoNJrc+i4bP6AgTO9l0PJ5OlAwxAQ1Qh4mAOIfazk
 ahpw/WzI1B/qC28zuKepFJS3x05InACb5pwv293AwgEiS/ROfpfAJQ8NGp54cWFm
 ge7/jBU19BX1HLC7PSleNStdwSi+oEKz7twtl+7n5kvgzi3eTJWnXGhYJWDGwpYY
 n9OZQBELliGhLnzeuDuGXddpVKQ0jbH+kchQ7dJAiN3jYq7FeYEsrapFmuae2r+N
 MEjEoKg4pmuf3z3Iru+XQ30xGCOs2lKz9LfowxRcl5xTqxmH5XxqZZF/UdQITXh0
 VYLRjhSfA5Fp2kUHmPayvkLHkzILzNjSF1Vqhk2En2C99RSywcJkvaFr5cnE3v3a
 gueO8eZ+QRSXQVpKCTHS98wPcJrnzPXSTpwF9uKSHKBzNWIee3tLHRZb1nvUuHKo
 bNB2iEDwracb5eEpOoa+7L0VOS8M6sFnAveWF9yNVR9vG36Cs7eXtrFIk/xQmr2s
 FlqjPpx1xWodnE9IxrJi8qSJxAgJtrO6UG1gut7lBK6RHIhkt2B7YUQPr30V8zVx
 f3FszNERZe/D/bvgM5WHyoieMnp5sZAxq0f7pk+2pOTIqvlbojWCAGoqP2P6BN2Y
 mu9lnM3D6k/GfLNbww==
 =A0dK
 -----END PGP SIGNATURE-----

Merge tag 'exfat-for-6.18-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/linkinjeon/exfat

Pull exfat fixes from Namjae Jeon:

 - Fix out-of-bounds in FS_IOC_SETFSLABEL

 - Add validation for stream entry size to prevent infinite loop

* tag 'exfat-for-6.18-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/linkinjeon/exfat:
  exfat: fix out-of-bounds in exfat_nls_to_ucs2()
  exfat: fix improper check of dentry.stream.valid_size
This commit is contained in:
Linus Torvalds 2025-10-18 07:23:59 -10:00
parent 2d07c6c209 2d8636119b
commit 847f242f7a
4 changed files with 10 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
fs/exfat/exfat_fs.h
View File

@ -29,7 +29,6 @@ enum exfat_error_mode {
enum {
NLS_NAME_NO_LOSSY = 0, /* no lossy */
NLS_NAME_LOSSY = 1 << 0, /* just detected incorrect filename(s) */
NLS_NAME_OVERLEN = 1 << 1, /* the length is over than its limit */
};
#define EXFAT_HASH_BITS 8

7
fs/exfat/file.c
View File

@ -509,8 +509,8 @@ static int exfat_ioctl_get_volume_label(struct super_block *sb, unsigned long ar
static int exfat_ioctl_set_volume_label(struct super_block *sb,
unsigned long arg)
{
int ret = 0, lossy;
char label[FSLABEL_MAX];
int ret = 0, lossy, label_len;
char label[FSLABEL_MAX] = {0};
struct exfat_uni_name uniname;
if (!capable(CAP_SYS_ADMIN))
@ -520,8 +520,9 @@ static int exfat_ioctl_set_volume_label(struct super_block *sb,
return -EFAULT;
memset(&uniname, 0, sizeof(uniname));
label_len = strnlen(label, FSLABEL_MAX - 1);
if (label[0]) {
ret = exfat_nls_to_utf16(sb, label, FSLABEL_MAX,
ret = exfat_nls_to_utf16(sb, label, label_len,
&uniname, &lossy);
if (ret < 0)
return ret;

8
fs/exfat/namei.c
View File

@ -442,7 +442,7 @@ static int __exfat_resolve_path(struct inode *inode, const unsigned char *path,
return namelen; /* return error value */
if ((lossy && !lookup) || !namelen)
return (lossy & NLS_NAME_OVERLEN) ? -ENAMETOOLONG : -EINVAL;
return -EINVAL;
return 0;
}
@ -642,10 +642,14 @@ static int exfat_find(struct inode *dir, const struct qstr *qname,
info->type = exfat_get_entry_type(ep);
info->attr = le16_to_cpu(ep->dentry.file.attr);
info->size = le64_to_cpu(ep2->dentry.stream.valid_size);
info->valid_size = le64_to_cpu(ep2->dentry.stream.valid_size);
info->size = le64_to_cpu(ep2->dentry.stream.size);
if (info->valid_size < 0) {
exfat_fs_error(sb, "data valid size is invalid(%lld)", info->valid_size);
return -EIO;
}
if (unlikely(EXFAT_B_TO_CLU_ROUND_UP(info->size, sbi) > sbi->used_clusters)) {
exfat_fs_error(sb, "data size is invalid(%lld)", info->size);
return -EIO;

3
fs/exfat/nls.c
View File

@ -616,9 +616,6 @@ static int exfat_nls_to_ucs2(struct super_block *sb,
unilen++;
}
if (p_cstring[i] != '\0')
lossy |= NLS_NAME_OVERLEN;
*uniname = '\0';
p_uniname->name_len = unilen;
p_uniname->name_hash = exfat_calc_chksum16(upname, unilen << 1, 0,