Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
From:   "Namjae Jeon" <namjae.jeon@samsung.com>
To:     "'Matthew Wilcox'" <willy@infradead.org>
Cc:     <linux-fsdevel@vger.kernel.org>, <linux-kernel@vger.kernel.org>,
        <sj1557.seo@samsung.com>, <syzkaller-bugs@googlegroups.com>,
        "'syzbot'" <syzbot+da4fe66aaadd3c2e2d1c@syzkaller.appspotmail.com>
In-Reply-To: <20210125183918.GH308988@casper.infradead.org>
Subject: RE: UBSAN: shift-out-of-bounds in exfat_fill_super
Date:   Tue, 26 Jan 2021 13:40:08 +0900
Message-ID: <051e01d6f39d$537a0910$fa6e1b30$@samsung.com>
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Thread-Index: AQKx/jOXwjWHcb1Mo6E7TSXbn6EBcQJApmhQAe65oTeoYcKoMA==
Content-Language: ko
Content-Type: text/plain; charset="utf-8"
CMS-TYPE: 101P
DLP-Filter: Pass
References: <000000000000c2865c05b9bcee02@google.com>
        <CGME20210125184007epcas1p39999c1e4325b738e4ff5e42899b8f6b7@epcas1p3.samsung.com>
        <20210125183918.GH308988@casper.infradead.org>
Precedence: bulk

> On Mon, Jan 25, 2021 at 09:33:14AM -0800, syzbot wrote:
> > UBSAN: shift-out-of-bounds in fs/exfat/super.c:471:28 shift exponent
> > 4294967294 is too large for 32-bit type 'int'
> 
> This is an integer underflow:
> 
>         sbi->dentries_per_clu = 1 <<
>                 (sbi->cluster_size_bits - DENTRY_SIZE_BITS);
> 
> I think the problem is that there is no validation of sect_per_clus_bits.
> We should check it is at least DENTRY_SIZE_BITS and probably that it's less than ... 16?  64?  I don't
> know what legitimate values are in this field, but I would imagine that 255 is completely unacceptable.
exfat specification describe sect_per_clus_bits field of boot sector could be at most 32 and
at least 0. And sect_size_bits can also affect this calculation, It also needs validation.
I will fix it.
Thanks!