Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
From:   "Namjae Jeon" <namjae.jeon@samsung.com>
To:     "'Randy Dunlap'" <rdunlap@infradead.org>
Cc:     <linux-fsdevel@vger.kernel.org>, <linux-kernel@vger.kernel.org>,
        <sj1557.seo@samsung.com>, <syzkaller-bugs@googlegroups.com>,
        "'syzbot'" <syzbot+da4fe66aaadd3c2e2d1c@syzkaller.appspotmail.com>,
        "'Matthew Wilcox'" <willy@infradead.org>
In-Reply-To: <40b5993e-d99e-b2b9-6568-80e46e2d3cb1@infradead.org>
Subject: RE: UBSAN: shift-out-of-bounds in exfat_fill_super
Date:   Tue, 26 Jan 2021 14:14:36 +0900
Message-ID: <052201d6f3a2$23f468c0$6bdd3a40$@samsung.com>
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Thread-Index: AQKx/jOXwjWHcb1Mo6E7TSXbn6EBcQHuuaE3ApB445ICJF3SPahOIchQ
Content-Language: ko
Content-Type: text/plain; charset="utf-8"
CMS-TYPE: 101P
DLP-Filter: Pass
References: <000000000000c2865c05b9bcee02@google.com>
        <20210125183918.GH308988@casper.infradead.org>
        <CGME20210126043409epcas1p4c035b515ac6e34f1773e890c148d39d7@epcas1p4.samsung.com>
        <40b5993e-d99e-b2b9-6568-80e46e2d3cb1@infradead.org>
Precedence: bulk

> On 1/25/21 10:39 AM, Matthew Wilcox wrote:
> > On Mon, Jan 25, 2021 at 09:33:14AM -0800, syzbot wrote:
> >> UBSAN: shift-out-of-bounds in fs/exfat/super.c:471:28 shift exponent
> >> 4294967294 is too large for 32-bit type 'int'
> >
> > This is an integer underflow:
> >
> >         sbi->dentries_per_clu = 1 <<
> >                 (sbi->cluster_size_bits - DENTRY_SIZE_BITS);
> >
> > I think the problem is that there is no validation of sect_per_clus_bits.
> > We should check it is at least DENTRY_SIZE_BITS and probably that it's
> > less than ... 16?  64?  I don't know what legitimate values are in
> > this field, but I would imagine that 255 is completely unacceptable.
> 
> Ack all of that. The syzbot boot_sector has sect_per_clus_bits == 3 and sect_size_bits == 0, so sbi-
> >cluster_size_bits is 3, then UBSAN goes bang on:
> 
> 	sbi->dentries_per_clu = 1 <<
> 		(sbi->cluster_size_bits - DENTRY_SIZE_BITS); // 3 - 5
> 
> 
> There is also an unprotected shift at line 480:
> 
> 	if (sbi->num_FAT_sectors << p_boot->sect_size_bits <
> 	    sbi->num_clusters * 4) {
> 
> that should be protected IMO.
Right. I will also add validation for fat_length as well as sect_size_bits before this.

Thanks!
> 
> 
> --
> ~Randy