Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
Date:   Mon, 25 Jan 2021 18:39:18 +0000
From:   Matthew Wilcox <willy@infradead.org>
To:     syzbot <syzbot+da4fe66aaadd3c2e2d1c@syzkaller.appspotmail.com>
Cc:     linux-fsdevel@vger.kernel.org, linux-kernel@vger.kernel.org,
        namjae.jeon@samsung.com, sj1557.seo@samsung.com,
        syzkaller-bugs@googlegroups.com
Subject: Re: UBSAN: shift-out-of-bounds in exfat_fill_super
Message-ID: <20210125183918.GH308988@casper.infradead.org>
References: <000000000000c2865c05b9bcee02@google.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <000000000000c2865c05b9bcee02@google.com>
Precedence: bulk

On Mon, Jan 25, 2021 at 09:33:14AM -0800, syzbot wrote:
> UBSAN: shift-out-of-bounds in fs/exfat/super.c:471:28
> shift exponent 4294967294 is too large for 32-bit type 'int'

This is an integer underflow:

        sbi->dentries_per_clu = 1 <<
                (sbi->cluster_size_bits - DENTRY_SIZE_BITS);

I think the problem is that there is no validation of sect_per_clus_bits.
We should check it is at least DENTRY_SIZE_BITS and probably that it's
less than ... 16?  64?  I don't know what legitimate values are in this
field, but I would imagine that 255 is completely unacceptable.