linux-kernel - Re: [Linux Kernel Bug] divide error in exfat_load

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <CAKYAXd-eqH0HW_=bvTBx+ETtLO505ELRNMcjnUtFgq4waAMEVQ@mail.gmail.com>
Date: Mon, 17 Nov 2025 17:18:48 +0900
From: Namjae Jeon <linkinjeon@...nel.org>
To: Jiaming Zhang <r772577952@...il.com>
Cc: linux-fsdevel@...r.kernel.org, sj1557.seo@...sung.com, 
	linux-kernel@...r.kernel.org, yuezhang.mo@...y.com, 
	syzkaller@...glegroups.com
Subject: Re: [Linux Kernel Bug] divide error in exfat_load_bitmap

On Mon, Nov 17, 2025 at 3:55 PM Jiaming Zhang <r772577952@...il.com> wrote:
>
> Dear Linux kernel developers and maintainers,
>
> We are writing to report a divide error bug discovered in the exfat
> subsystem. This bug is reproducible on the latest version (v6.18-rc6,
> commit 6a23ae0a96a600d1d12557add110e0bb6e32730c).
>
> The root cause is in exfat_allocate_bitmap(), the variable
> max_ra_count can be 0, which causes a divide-by-zero error in the
> subsequent modulo operation (i % max_ra_count), leading to a system
> crash.
>
> As a potential fix, we can add a zero check before the loop, for example:
>
> ```
> static int exfat_allocate_bitmap(struct super_block *sb,
>     struct exfat_dentry *ep)
> {
>   struct exfat_sb_info *sbi = EXFAT_SB(sb);
>
>     ...
>
>   sector = exfat_cluster_to_sector(sbi, sbi->map_clu);
>   max_ra_count = min(sb->s_bdi->ra_pages, sb->s_bdi->io_pages) <<
>     (PAGE_SHIFT - sb->s_blocksize_bits);
> + if (!max_ra_count) {
> +   i = 0;
> +   goto err_out;
> + }
>   for (i = 0; i < sbi->map_sectors; i++) {
>     /* Trigger the next readahead in advance. */
>     if (0 == (i % max_ra_count)) {
>             ...
> ```
>
> If this solution is acceptable, we are happy to prepare and submit a
> patch immediately.
Rather than handling it as an error, it is better to not use readahead as below.
Please review it.

diff --git a/fs/exfat/balloc.c b/fs/exfat/balloc.c
index 2d2d510f2372..0b6466b3490a 100644
--- a/fs/exfat/balloc.c
+++ b/fs/exfat/balloc.c
@@ -106,7 +106,7 @@ static int exfat_allocate_bitmap(struct super_block *sb,
                (PAGE_SHIFT - sb->s_blocksize_bits);
        for (i = 0; i < sbi->map_sectors; i++) {
                /* Trigger the next readahead in advance. */
-               if (0 == (i % max_ra_count)) {
+               if (max_ra_count && 0 == (i % max_ra_count)) {
                        blk_start_plug(&plug);
                        for (j = i; j < min(max_ra_count,
sbi->map_sectors - i) + i; j++)
                                sb_breadahead(sb, sector + j);

Thank you for reporting this issue!