Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
Subject: Re: UBSAN: shift-out-of-bounds in exfat_fill_super
To:     Matthew Wilcox <willy@infradead.org>,
        syzbot <syzbot+da4fe66aaadd3c2e2d1c@syzkaller.appspotmail.com>
Cc:     linux-fsdevel@vger.kernel.org, linux-kernel@vger.kernel.org,
        namjae.jeon@samsung.com, sj1557.seo@samsung.com,
        syzkaller-bugs@googlegroups.com
References: <000000000000c2865c05b9bcee02@google.com>
 <20210125183918.GH308988@casper.infradead.org>
From:   Randy Dunlap <rdunlap@infradead.org>
Message-ID: <40b5993e-d99e-b2b9-6568-80e46e2d3cb1@infradead.org>
Date:   Mon, 25 Jan 2021 20:33:54 -0800
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101
 Thunderbird/78.4.0
MIME-Version: 1.0
In-Reply-To: <20210125183918.GH308988@casper.infradead.org>
Content-Type: text/plain; charset=utf-8
Content-Language: en-US
Content-Transfer-Encoding: 7bit
Precedence: bulk

On 1/25/21 10:39 AM, Matthew Wilcox wrote:
> On Mon, Jan 25, 2021 at 09:33:14AM -0800, syzbot wrote:
>> UBSAN: shift-out-of-bounds in fs/exfat/super.c:471:28
>> shift exponent 4294967294 is too large for 32-bit type 'int'
> 
> This is an integer underflow:
> 
>         sbi->dentries_per_clu = 1 <<
>                 (sbi->cluster_size_bits - DENTRY_SIZE_BITS);
> 
> I think the problem is that there is no validation of sect_per_clus_bits.
> We should check it is at least DENTRY_SIZE_BITS and probably that it's
> less than ... 16?  64?  I don't know what legitimate values are in this
> field, but I would imagine that 255 is completely unacceptable.

Ack all of that. The syzbot boot_sector has sect_per_clus_bits == 3
and sect_size_bits == 0, so sbi->cluster_size_bits is 3, then
UBSAN goes bang on:

	sbi->dentries_per_clu = 1 <<
		(sbi->cluster_size_bits - DENTRY_SIZE_BITS); // 3 - 5


There is also an unprotected shift at line 480:

	if (sbi->num_FAT_sectors << p_boot->sect_size_bits <
	    sbi->num_clusters * 4) {

that should be protected IMO.


-- 
~Randy