linux-kernel - Re: PROBLEM: [kernel BUG at fs/fat/inode.c:162] when writing to a broken VFAT

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Sat, 02 Jun 2018 20:19:28 +0900
From:   OGAWA Hirofumi <hirofumi@...l.parknet.co.jp>
To:     Anatoly Trosinenko <anatoly.trosinenko@...il.com>
Cc:     Andrew Morton <akpm@...ux-foundation.org>,
        linux-kernel@...r.kernel.org
Subject: Re: PROBLEM: [kernel BUG at fs/fat/inode.c:162] when writing to a broken VFAT

Anatoly Trosinenko <anatoly.trosinenko@...il.com> writes:

> Description:
>
> Writing to some file on a broken VFAT partition causes kernel bug

Thanks. This patch should fix this issue.
-- 
OGAWA Hirofumi <hirofumi@...l.parknet.co.jp>


[PATCH] fat: Use fat_fs_error() instead of BUG_ON() in __fat_get_block()

If file size and FAT cluster chain is not matched (corrupted image),
we can hit BUG_ON(!phys) in __fat_get_block().

So, use fat_fs_error() instead.

Signed-off-by: OGAWA Hirofumi <hirofumi@...l.parknet.co.jp>
---

 fs/fat/inode.c |    7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff -puN fs/fat/inode.c~vfat-dont-bugon fs/fat/inode.c
--- linux/fs/fat/inode.c~vfat-dont-bugon	2018-06-02 20:15:04.441920069 +0900
+++ linux-hirofumi/fs/fat/inode.c	2018-06-02 20:15:04.442920067 +0900
@@ -158,8 +158,13 @@ static inline int __fat_get_block(struct
 	err = fat_bmap(inode, iblock, &phys, &mapped_blocks, create, false);
 	if (err)
 		return err;
+	if (!phys) {
+		fat_fs_error(sb,
+			     "invalid FAT chain (i_pos %lld, last_block %ld)",
+			     MSDOS_I(inode)->i_pos, last_block);
+		return -EIO;
+	}
 
-	BUG_ON(!phys);
 	BUG_ON(*max_blocks != mapped_blocks);
 	set_buffer_new(bh_result);
 	map_bh(bh_result, sb, phys);
_