linux-kernel - [PATCH] exfat: Use str length when converting to utf16

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <tencent_EF3C9D37FE967C36364A3E748F77F966C009@qq.com>
Date: Tue, 14 Oct 2025 12:39:02 +0800
From: Edward Adam Davis <eadavis@...com>
To: syzbot+29934710e7fb9cb71f33@...kaller.appspotmail.com
Cc: ethan.ferguson@...ier.com,
	linkinjeon@...nel.org,
	linux-fsdevel@...r.kernel.org,
	linux-kernel@...r.kernel.org,
	sj1557.seo@...sung.com,
	syzkaller-bugs@...glegroups.com,
	yuezhang.mo@...y.com
Subject: [PATCH] exfat: Use str length when converting to utf16

syz reported a stack-out-of-bounds Read in exfat_nls_to_ucs2. [1]

Although general ioctl supports label of FSLABEL_MAX chars, when operating
on label passed in by the user, we should use strnlen to obtain the actual
character length instead of FSLABEL_MAX.

[1]
BUG: KASAN: stack-out-of-bounds in exfat_nls_to_ucs2+0x706/0x730 fs/exfat/nls.c:619
Read of size 1 at addr ffffc9000383fcc8 by task syz.0.17/5984
Call Trace:
 exfat_nls_to_ucs2+0x706/0x730 fs/exfat/nls.c:619
 exfat_nls_to_utf16+0xa6/0xf0 fs/exfat/nls.c:647
 exfat_ioctl_set_volume_label+0x15d/0x230 fs/exfat/file.c:524

Fixes: d01579d590f7 ("exfat: Add support for FS_IOC_{GET,SET}FSLABEL")
Reported-by: syzbot+29934710e7fb9cb71f33@...kaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=29934710e7fb9cb71f33
Tested-by: syzbot+29934710e7fb9cb71f33@...kaller.appspotmail.com
Signed-off-by: Edward Adam Davis <eadavis@...com>
---
 fs/exfat/file.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/fs/exfat/file.c b/fs/exfat/file.c
index f246cf439588..c4001e1c289d 100644
--- a/fs/exfat/file.c
+++ b/fs/exfat/file.c
@@ -509,8 +509,8 @@ static int exfat_ioctl_get_volume_label(struct super_block *sb, unsigned long ar
 static int exfat_ioctl_set_volume_label(struct super_block *sb,
 					unsigned long arg)
 {
-	int ret = 0, lossy;
-	char label[FSLABEL_MAX];
+	int ret = 0, lossy, len;
+	char label[FSLABEL_MAX] = {0};
 	struct exfat_uni_name uniname;
 
 	if (!capable(CAP_SYS_ADMIN))
@@ -519,9 +519,10 @@ static int exfat_ioctl_set_volume_label(struct super_block *sb,
 	if (copy_from_user(label, (char __user *)arg, FSLABEL_MAX))
 		return -EFAULT;
 
+	len = strnlen(label, FSLABEL_MAX);
 	memset(&uniname, 0, sizeof(uniname));
 	if (label[0]) {
-		ret = exfat_nls_to_utf16(sb, label, FSLABEL_MAX,
+		ret = exfat_nls_to_utf16(sb, label, len,
 					 &uniname, &lossy);
 		if (ret < 0)
 			return ret;
-- 
2.43.0