diff options
| author | Namjae Jeon <linkinjeon@kernel.org> | 2024-10-26 13:06:15 +0900 |
|---|---|---|
| committer | Namjae Jeon <linkinjeon@kernel.org> | 2024-11-25 17:08:21 +0900 |
| commit | 02dffe9ab092fc4c8800aee68cb7eafd37a980c4 (patch) | |
| tree | 2306a3537055b803d235a18465cc42809e574319 /fs | |
| parent | 184fa506e392eb78364d9283c961217ff2c0617b (diff) | |
exfat: fix uninit-value in __exfat_get_dentry_set
There is no check if stream size and start_clu are invalid.
If start_clu is EOF cluster and stream size is 4096, It will
cause uninit value access. because ei->hint_femp.eidx could
be 128(if cluster size is 4K) and wrong hint will allocate
next cluster. and this cluster will be same with the cluster
that is allocated by exfat_extend_valid_size(). The previous
patch will check invalid start_clu, but for clarity, initialize
hint_femp.eidx to zero.
Cc: stable@vger.kernel.org
Reported-by: syzbot+01218003be74b5e1213a@syzkaller.appspotmail.com
Tested-by: syzbot+01218003be74b5e1213a@syzkaller.appspotmail.com
Reviewed-by: Yuezhang Mo <Yuezhang.Mo@sony.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Diffstat (limited to 'fs')
| -rw-r--r-- | fs/exfat/namei.c | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/fs/exfat/namei.c b/fs/exfat/namei.c index 98f67e632ad1..337197ece599 100644 --- a/fs/exfat/namei.c +++ b/fs/exfat/namei.c @@ -345,6 +345,7 @@ static int exfat_find_empty_entry(struct inode *inode, if (ei->start_clu == EXFAT_EOF_CLUSTER) { ei->start_clu = clu.dir; p_dir->dir = clu.dir; + hint_femp.eidx = 0; } /* append to the FAT chain */ |