5d39deced1
syzbot reported a warning which could cause shift-out-of-bounds issue.
Call Trace:
__dump_stack lib/dump_stack.c:79 [inline]
dump_stack+0x183/0x22e lib/dump_stack.c:120
ubsan_epilogue lib/ubsan.c:148 [inline]
__ubsan_handle_shift_out_of_bounds+0x432/0x4d0 lib/ubsan.c:395
exfat_read_boot_sector fs/exfat/super.c:471 [inline]
__exfat_fill_super fs/exfat/super.c:556 [inline]
exfat_fill_super+0x2acb/0x2d00 fs/exfat/super.c:624
get_tree_bdev+0x406/0x630 fs/super.c:1291
vfs_get_tree+0x86/0x270 fs/super.c:1496
do_new_mount fs/namespace.c:2881 [inline]
path_mount+0x1937/0x2c50 fs/namespace.c:3211
do_mount fs/namespace.c:3224 [inline]
__do_sys_mount fs/namespace.c:3432 [inline]
__se_sys_mount+0x2f9/0x3b0 fs/namespace.c:3409
do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
entry_SYSCALL_64_after_hwframe+0x44/0xa9
exfat specification describe sect_per_clus_bits field of boot sector
could be at most 25 - sect_size_bits and at least 0. And sect_size_bits
can also affect this calculation, It also needs validation.
This patch add validation for sect_per_clus_bits and sect_size_bits
field of boot sector.
Fixes: 719c1e182916 ("exfat: add super block operations")
Cc: stable@vger.kernel.org # v5.9+
Reported-by: syzbot+da4fe66aaadd3c2e2d1c@syzkaller.appspotmail.com
Reviewed-by: Sungjong Seo <sj1557.seo@samsung.com>
Tested-by: Randy Dunlap <rdunlap@infradead.org>
Signed-off-by: Namjae Jeon <namjae.jeon@samsung.com>
169 lines
4.3 KiB
C
169 lines
4.3 KiB
C
/* SPDX-License-Identifier: GPL-2.0-or-later */
|
|
/*
|
|
* Copyright (C) 2012-2013 Samsung Electronics Co., Ltd.
|
|
*/
|
|
|
|
#ifndef _EXFAT_RAW_H
|
|
#define _EXFAT_RAW_H
|
|
|
|
#include <linux/types.h>
|
|
|
|
#define BOOT_SIGNATURE 0xAA55
|
|
#define EXBOOT_SIGNATURE 0xAA550000
|
|
#define STR_EXFAT "EXFAT " /* size should be 8 */
|
|
|
|
#define EXFAT_MAX_FILE_LEN 255
|
|
|
|
#define VOLUME_DIRTY 0x0002
|
|
#define MEDIA_FAILURE 0x0004
|
|
|
|
#define EXFAT_EOF_CLUSTER 0xFFFFFFFFu
|
|
#define EXFAT_BAD_CLUSTER 0xFFFFFFF7u
|
|
#define EXFAT_FREE_CLUSTER 0
|
|
/* Cluster 0, 1 are reserved, the first cluster is 2 in the cluster heap. */
|
|
#define EXFAT_RESERVED_CLUSTERS 2
|
|
#define EXFAT_FIRST_CLUSTER 2
|
|
#define EXFAT_DATA_CLUSTER_COUNT(sbi) \
|
|
((sbi)->num_clusters - EXFAT_RESERVED_CLUSTERS)
|
|
|
|
/* AllocationPossible and NoFatChain field in GeneralSecondaryFlags Field */
|
|
#define ALLOC_FAT_CHAIN 0x01
|
|
#define ALLOC_NO_FAT_CHAIN 0x03
|
|
|
|
#define DENTRY_SIZE 32 /* directory entry size */
|
|
#define DENTRY_SIZE_BITS 5
|
|
/* exFAT allows 8388608(256MB) directory entries */
|
|
#define MAX_EXFAT_DENTRIES 8388608
|
|
|
|
/* dentry types */
|
|
#define EXFAT_UNUSED 0x00 /* end of directory */
|
|
#define EXFAT_DELETE (~0x80)
|
|
#define IS_EXFAT_DELETED(x) ((x) < 0x80) /* deleted file (0x01~0x7F) */
|
|
#define EXFAT_INVAL 0x80 /* invalid value */
|
|
#define EXFAT_BITMAP 0x81 /* allocation bitmap */
|
|
#define EXFAT_UPCASE 0x82 /* upcase table */
|
|
#define EXFAT_VOLUME 0x83 /* volume label */
|
|
#define EXFAT_FILE 0x85 /* file or dir */
|
|
#define EXFAT_GUID 0xA0
|
|
#define EXFAT_PADDING 0xA1
|
|
#define EXFAT_ACLTAB 0xA2
|
|
#define EXFAT_STREAM 0xC0 /* stream entry */
|
|
#define EXFAT_NAME 0xC1 /* file name entry */
|
|
#define EXFAT_ACL 0xC2 /* stream entry */
|
|
|
|
#define IS_EXFAT_CRITICAL_PRI(x) (x < 0xA0)
|
|
#define IS_EXFAT_BENIGN_PRI(x) (x < 0xC0)
|
|
#define IS_EXFAT_CRITICAL_SEC(x) (x < 0xE0)
|
|
|
|
/* checksum types */
|
|
#define CS_DIR_ENTRY 0
|
|
#define CS_BOOT_SECTOR 1
|
|
#define CS_DEFAULT 2
|
|
|
|
/* file attributes */
|
|
#define ATTR_READONLY 0x0001
|
|
#define ATTR_HIDDEN 0x0002
|
|
#define ATTR_SYSTEM 0x0004
|
|
#define ATTR_VOLUME 0x0008
|
|
#define ATTR_SUBDIR 0x0010
|
|
#define ATTR_ARCHIVE 0x0020
|
|
|
|
#define ATTR_RWMASK (ATTR_HIDDEN | ATTR_SYSTEM | ATTR_VOLUME | \
|
|
ATTR_SUBDIR | ATTR_ARCHIVE)
|
|
|
|
#define BOOTSEC_JUMP_BOOT_LEN 3
|
|
#define BOOTSEC_FS_NAME_LEN 8
|
|
#define BOOTSEC_OLDBPB_LEN 53
|
|
|
|
#define EXFAT_FILE_NAME_LEN 15
|
|
|
|
#define EXFAT_MIN_SECT_SIZE_BITS 9
|
|
#define EXFAT_MAX_SECT_SIZE_BITS 12
|
|
#define EXFAT_MAX_SECT_PER_CLUS_BITS(x) (25 - (x)->sect_size_bits)
|
|
|
|
/* EXFAT: Main and Backup Boot Sector (512 bytes) */
|
|
struct boot_sector {
|
|
__u8 jmp_boot[BOOTSEC_JUMP_BOOT_LEN];
|
|
__u8 fs_name[BOOTSEC_FS_NAME_LEN];
|
|
__u8 must_be_zero[BOOTSEC_OLDBPB_LEN];
|
|
__le64 partition_offset;
|
|
__le64 vol_length;
|
|
__le32 fat_offset;
|
|
__le32 fat_length;
|
|
__le32 clu_offset;
|
|
__le32 clu_count;
|
|
__le32 root_cluster;
|
|
__le32 vol_serial;
|
|
__u8 fs_revision[2];
|
|
__le16 vol_flags;
|
|
__u8 sect_size_bits;
|
|
__u8 sect_per_clus_bits;
|
|
__u8 num_fats;
|
|
__u8 drv_sel;
|
|
__u8 percent_in_use;
|
|
__u8 reserved[7];
|
|
__u8 boot_code[390];
|
|
__le16 signature;
|
|
} __packed;
|
|
|
|
struct exfat_dentry {
|
|
__u8 type;
|
|
union {
|
|
struct {
|
|
__u8 num_ext;
|
|
__le16 checksum;
|
|
__le16 attr;
|
|
__le16 reserved1;
|
|
__le16 create_time;
|
|
__le16 create_date;
|
|
__le16 modify_time;
|
|
__le16 modify_date;
|
|
__le16 access_time;
|
|
__le16 access_date;
|
|
__u8 create_time_cs;
|
|
__u8 modify_time_cs;
|
|
__u8 create_tz;
|
|
__u8 modify_tz;
|
|
__u8 access_tz;
|
|
__u8 reserved2[7];
|
|
} __packed file; /* file directory entry */
|
|
struct {
|
|
__u8 flags;
|
|
__u8 reserved1;
|
|
__u8 name_len;
|
|
__le16 name_hash;
|
|
__le16 reserved2;
|
|
__le64 valid_size;
|
|
__le32 reserved3;
|
|
__le32 start_clu;
|
|
__le64 size;
|
|
} __packed stream; /* stream extension directory entry */
|
|
struct {
|
|
__u8 flags;
|
|
__le16 unicode_0_14[EXFAT_FILE_NAME_LEN];
|
|
} __packed name; /* file name directory entry */
|
|
struct {
|
|
__u8 flags;
|
|
__u8 reserved[18];
|
|
__le32 start_clu;
|
|
__le64 size;
|
|
} __packed bitmap; /* allocation bitmap directory entry */
|
|
struct {
|
|
__u8 reserved1[3];
|
|
__le32 checksum;
|
|
__u8 reserved2[12];
|
|
__le32 start_clu;
|
|
__le64 size;
|
|
} __packed upcase; /* up-case table directory entry */
|
|
} __packed dentry;
|
|
} __packed;
|
|
|
|
#define EXFAT_TZ_VALID (1 << 7)
|
|
|
|
/* Jan 1 GMT 00:00:00 1980 */
|
|
#define EXFAT_MIN_TIMESTAMP_SECS 315532800LL
|
|
/* Dec 31 GMT 23:59:59 2107 */
|
|
#define EXFAT_MAX_TIMESTAMP_SECS 4354819199LL
|
|
|
|
#endif /* !_EXFAT_RAW_H */
|