linux-kernel - [PATCH] vfat: don't read garbage after last dirent

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <20181207013410.7050-1-mcroce@redhat.com>
Date:   Fri,  7 Dec 2018 02:34:10 +0100
From:   Matteo Croce <mcroce@...hat.com>
To:     OGAWA Hirofumi <hirofumi@...l.parknet.co.jp>
Cc:     Timothy Redaelli <tredaelli@...hat.com>,
        linux-kernel@...r.kernel.org
Subject: [PATCH] vfat: don't read garbage after last dirent

The FAT32 File System Specification[1] states:

    If DIR_Name[0] == 0x00, then the directory entry is free, and there
    are no allocated directory entries after this one.

    The special 0 value, indicates to FAT file system driver code that
    the rest of the entries in this directory do notneed to be examined
    because they are all free.

This is not enforced by Linux, and is possible to read garbage if
not all the dirents after the last one are filled with zeroes.

[1] http://download.microsoft.com/download/1/6/1/161ba512-40e2-4cc9-843a-923143f3456c/fatgen103.doc

Reported-by: Timothy Redaelli <tredaelli@...hat.com>
Signed-off-by: Matteo Croce <mcroce@...hat.com>
---
 fs/fat/dir.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/fat/dir.c b/fs/fat/dir.c
index c8366cb8eccd..0cec89271349 100644
--- a/fs/fat/dir.c
+++ b/fs/fat/dir.c
@@ -588,7 +588,7 @@ static int __fat_readdir(struct inode *inode, struct file *file,
 
 	bh = NULL;
 get_new:
-	if (fat_get_entry(inode, &cpos, &bh, &de) == -1)
+	if (fat_get_entry(inode, &cpos, &bh, &de) == -1 || !de->name[0])
 		goto end_of_dir;
 parse_record:
 	nr_slots = 0;
-- 
2.19.2