Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
From:   "Namjae Jeon" <namjae.jeon@samsung.com>
To:     "'Matthew Wilcox'" <willy@infradead.org>
Cc:     <linux-fsdevel@vger.kernel.org>, <linux-kernel@vger.kernel.org>,
        <sj1557.seo@samsung.com>, <syzkaller-bugs@googlegroups.com>,
        "'syzbot'" <syzbot+da4fe66aaadd3c2e2d1c@syzkaller.appspotmail.com>
In-Reply-To: 
Subject: RE: UBSAN: shift-out-of-bounds in exfat_fill_super
Date:   Tue, 26 Jan 2021 14:08:03 +0900
Message-ID: <052101d6f3a1$3997c420$acc74c60$@samsung.com>
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Thread-Index: AQKx/jOXwjWHcb1Mo6E7TSXbn6EBcQJApmhQAe65oTeoYcKoMIAAB+GA
Content-Language: ko
Content-Type: text/plain; charset="utf-8"
CMS-TYPE: 101P
DLP-Filter: Pass
References: <000000000000c2865c05b9bcee02@google.com>
        <CGME20210125184007epcas1p39999c1e4325b738e4ff5e42899b8f6b7@epcas1p3.samsung.com>
        <20210125183918.GH308988@casper.infradead.org> 
Precedence: bulk

> > On Mon, Jan 25, 2021 at 09:33:14AM -0800, syzbot wrote:
> > > UBSAN: shift-out-of-bounds in fs/exfat/super.c:471:28 shift exponent
> > > 4294967294 is too large for 32-bit type 'int'
> >
> > This is an integer underflow:
> >
> >         sbi->dentries_per_clu = 1 <<
> >                 (sbi->cluster_size_bits - DENTRY_SIZE_BITS);
> >
> > I think the problem is that there is no validation of sect_per_clus_bits.
> > We should check it is at least DENTRY_SIZE_BITS and probably that it's
> > less than ... 16?  64?  I don't know what legitimate values are in this field, but I would imagine
> that 255 is completely unacceptable.
> exfat specification describe sect_per_clus_bits field of boot sector could be at most 32 and at least
                                                                                                 typo ^^16
> 0. And sect_size_bits can also affect this calculation, It also needs validation.
> I will fix it.
> Thanks!