[v1] exfat: fix the infinite loop in exfat_find_last_cluster()

Commit Message

[e-mail] March 20, 2025, 8:27 a.m. UTC

In exfat_find_last_cluster(), the cluster chain is traversed until
the EOF cluster. If the cluster chain includes a loop due to file
system corruption, the EOF cluster cannot be traversed, resulting
in an infinite loop.

If the number of clusters indicated by the file size is inconsistent
with the cluster chain length, exfat_find_last_cluster() will return
an error, so if this inconsistency is found, the traversal can be
aborted without traversing to the EOF cluster.

Reported-by: [e-mail]
Closes: https://syzkaller.appspot.com/bug?extid=f7d147e6db52b1e09dba
Tested-by: [e-mail]
Fixes: 31023864e67a ("exfat: add fat entry operations")
Signed-off-by: Yuezhang Mo <[e-mail]>
---
 fs/exfat/fatent.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

Comments

Namjae Jeon March 21, 2025, 12:01 p.m. UTC | #1

On Thu, Mar 20, 2025 at 5:28 PM [e-mail]
<[e-mail]> wrote:
>
> In exfat_find_last_cluster(), the cluster chain is traversed until
> the EOF cluster. If the cluster chain includes a loop due to file
> system corruption, the EOF cluster cannot be traversed, resulting
> in an infinite loop.
>
> If the number of clusters indicated by the file size is inconsistent
> with the cluster chain length, exfat_find_last_cluster() will return
> an error, so if this inconsistency is found, the traversal can be
> aborted without traversing to the EOF cluster.
>
> Reported-by: [e-mail]
> Closes: https://syzkaller.appspot.com/bug?extid=f7d147e6db52b1e09dba
> Tested-by: [e-mail]
> Fixes: 31023864e67a ("exfat: add fat entry operations")
> Signed-off-by: Yuezhang Mo <[e-mail]>
Applied it to #dev.
Thanks!

Patch

diff --git a/fs/exfat/fatent.c b/fs/exfat/fatent.c
index b9473a69f104..23065f948ae7 100644
--- a/fs/exfat/fatent.c
+++ b/fs/exfat/fatent.c
@@ -294,7 +294,7 @@  int exfat_find_last_cluster(struct super_block *sb, struct exfat_chain *p_chain,
 		clu = next;
 		if (exfat_ent_get(sb, clu, &next))
 			return -EIO;
-	} while (next != EXFAT_EOF_CLUSTER);
+	} while (next != EXFAT_EOF_CLUSTER && count <= p_chain->size);
 
 	if (p_chain->size != count) {
 		exfat_fs_error(sb,