diff options
| author | Namjae Jeon <linkinjeon@kernel.org> | 2025-11-12 09:42:25 +0900 |
|---|---|---|
| committer | Namjae Jeon <linkinjeon@kernel.org> | 2025-12-03 10:00:16 +0900 |
| commit | 866cba3675416c6cf446acb25d7c700eead1420e (patch) | |
| tree | b0888e6df12e2cd68144d13c8c0d8c606c7b72b7 /fs/exfat/dir.c | |
| parent | 4e163c39dd4e70fcdce948b8774d96e0482b4a11 (diff) | |
exfat: validate the cluster bitmap bits of directory
Syzbot created this issue by testing an image that did not have the root
cluster bitmap bit marked. After accessing a file through the root
directory via exfat_lookup, when creating a file again with mkdir,
the root cluster bit can be allocated for direcotry, which can cause
the root cluster to be zeroed out and the same entry can be allocated
in the same cluster. This patch improved this issue by adding
exfat_test_bitmap to validate the cluster bits of the root directory
and directory. And the first cluster bit of the root directory should
never be unset except when storage is corrupted. This bit is set to
allow operations after mount.
Reported-by: syzbot+5216036fc59c43d1ee02@syzkaller.appspotmail.com
Tested-by: syzbot+5216036fc59c43d1ee02@syzkaller.appspotmail.com
Reviewed-by: Sungjong Seo <sj1557.seo@samsung.com>
Reviewed-by: Yuezhang Mo <Yuezhang.Mo@sony.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Diffstat (limited to 'fs/exfat/dir.c')
| -rw-r--r-- | fs/exfat/dir.c | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/fs/exfat/dir.c b/fs/exfat/dir.c index 7229146fe2bf..3045a58e124a 100644 --- a/fs/exfat/dir.c +++ b/fs/exfat/dir.c @@ -604,6 +604,11 @@ static int exfat_find_location(struct super_block *sb, struct exfat_chain *p_dir if (ret) return ret; + if (!exfat_test_bitmap(sb, clu)) { + exfat_err(sb, "failed to test cluster bit(%u)", clu); + return -EIO; + } + /* byte offset in cluster */ off = EXFAT_CLU_OFFSET(off, sbi); |