linux-kernel - Re: [PATCH v2 10/13] exfat: support multi-cluster for exfat_map

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID:
 <PUZPR04MB6316586A2FCEA0BAECA86CB3818EA@PUZPR04MB6316.apcprd04.prod.outlook.com>
Date: Tue, 13 Jan 2026 10:26:58 +0000
From: "Yuezhang.Mo@...y.com" <Yuezhang.Mo@...y.com>
To: Chi Zhiling <chizhiling@....com>,
        "linux-fsdevel@...r.kernel.org"
	<linux-fsdevel@...r.kernel.org>,
        "linux-kernel@...r.kernel.org"
	<linux-kernel@...r.kernel.org>
CC: Namjae Jeon <linkinjeon@...nel.org>,
        Sungjong Seo
	<sj1557.seo@...sung.com>,
        Chi Zhiling <chizhiling@...inos.cn>
Subject: Re: [PATCH v2 10/13] exfat: support multi-cluster for
 exfat_map_cluster

> On 1/13/26 14:37, Yuezhang.Mo@...y.com wrote:
>>> @@ -281,7 +285,7 @@ static int exfat_get_block(struct inode *inode, sector_t iblock,
>>>         sec_offset = iblock & (sbi->sect_per_clus - 1);
>>>
>>>         phys = exfat_cluster_to_sector(sbi, cluster) + sec_offset;
>>> -       mapped_blocks = sbi->sect_per_clus - sec_offset;
>>> +       mapped_blocks = (count << sbi->sect_per_clus_bits) - sec_offset;
>>
>> This left shift will cause an overflow if the file is larger than 2TB
>> and the clusters are contiguous.
>
> Thank you for pointing this out, I will change the type to blkcnt_t in
> v3 to fix this bug.

I don't think it's necessary to change the type to blkcnt_t, because the type
of bh_result->b_size is size_t (aka unsigned long int).

The overflow was caused by '*count' being increased in exfat_map_cluster().
I think it should be fixed as below.

--- a/fs/exfat/inode.c
+++ b/fs/exfat/inode.c
@@ -153,7 +153,7 @@ static int exfat_map_cluster(struct inode *inode, unsigned int clu_offset,
                last_clu += num_clusters - 1;
                if (clu_offset < num_clusters) {
                        *clu += clu_offset;
-                       *count = num_clusters - clu_offset;
+                       *count = min(num_clusters - clu_offset, *count);
                } else {
                        *clu = EXFAT_EOF_CLUSTER;
                        *count = 0;
@@ -284,7 +284,7 @@ static int exfat_get_block(struct inode *inode, sector_t iblock,
        sec_offset = iblock & (sbi->sect_per_clus - 1);
 
        phys = exfat_cluster_to_sector(sbi, cluster) + sec_offset;
-       mapped_blocks = (count << sbi->sect_per_clus_bits) - sec_offset;
+       mapped_blocks = ((unsigned long)count << sbi->sect_per_clus_bits) - sec_offset;
        max_blocks = min(mapped_blocks, max_blocks);
 
        map_bh(bh_result, sb, phys);

> 
> diff --git a/fs/exfat/inode.c b/fs/exfat/inode.c
> index e8b74185b0ad..9c1e00f5b011 100644
> --- a/fs/exfat/inode.c
> +++ b/fs/exfat/inode.c
> @@ -250,9 +250,9 @@ static int exfat_get_block(struct inode *inode,
> sector_t iblock,
>         struct exfat_inode_info *ei = EXFAT_I(inode);
>         struct super_block *sb = inode->i_sb;
>         struct exfat_sb_info *sbi = EXFAT_SB(sb);
>-       unsigned long max_blocks = bh_result->b_size >> inode->i_blkbits;
>+       blkcnt_t max_blocks = EXFAT_B_TO_BLK(bh_result->b_size, sb);
>+       blkcnt_t mapped_blocks = 0;
>         int err = 0;
>-       unsigned long mapped_blocks = 0;
>         unsigned int cluster, sec_offset, count;
>         sector_t last_block;
>         sector_t phys = 0;
>
>>
>> The others look good.
>> Reviewed-by: Yuezhang Mo <Yuezhang.Mo@...y.com>
>
>
> Thanks,