linux-kernel - RE: [PATCH] exfat: tighten down num

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Mon, 17 Feb 2020 09:37:55 +0900
From:   "Namjae Jeon" <namjae.jeon@...sung.com>
To:     'Valdis Klētnieks' <valdis.kletnieks@...edu>
Cc:     <linux-fsdevel@...r.kernel.org>, <linux-kernel@...r.kernel.org>,
        <gregkh@...uxfoundation.org>, <hch@....de>,
        <sj1557.seo@...sung.com>, <pali.rohar@...il.com>, <arnd@...db.de>,
        <viro@...iv.linux.org.uk>, "'Namjae Jeon'" <linkinjeon@...il.com>,
        "'Sasha Levin'" <sashal@...nel.org>
Subject: RE: [PATCH] exfat: tighten down num_fats check

> Change the test for num_fats from != 0 to a check for specifically 1.
> 
> Although it's theoretically possible that num_fats == 2 for a TexFAT
> volume (or an implementation that doesn't do the full TexFAT but does
> support 2 FAT tables), the rest of the code doesn't currently DTRT if it's
> 2 (in particular, not handling the case of ActiveFat pointing at the
> second FAT area), so we'll disallow that as well, as well as dealing with
> corrupted images that have a trash non-zero value.
> 
> Signed-off-by: Valdis Kletnieks <valdis.kletnieks@...edu>
> 
> --- a/fs/exfat/super.c	2020-02-14 17:45:02.262274632 -0500
> +++ b/fs/exfat/super.c	2020-02-14 17:46:37.200343723 -0500
> @@ -450,7 +450,7 @@ static int __exfat_fill_super(struct sup
>  	}
> 
>  	p_bpb = (struct pbr64 *)p_pbr;
> -	if (!p_bpb->bsx.num_fats) {
> +	if (p_bpb->bsx.num_fats  != 1) {
>  		exfat_msg(sb, KERN_ERR, "bogus number of FAT structure");
Could you please update error message for the reason why num_fats is allowed
only 1?
>  		ret = -EINVAL;
>  		goto free_bh;
Let's remove exfat_mirror_bh(), FAT2_start_sector variable and the below
related codes together.

sbi->FAT2_start_sector = p_bpb->bsx.num_fats == 1 ?
                sbi->FAT1_start_sector :
                        sbi->FAT1_start_sector + sbi->num_FAT_sectors;

Thanks for your patch!
> 
> 
> 
>