exfat: fix out-of-bounds in exfat_nls_to_ucs2()

Since the len argument value passed to exfat_ioctl_set_volume_label()
from exfat_nls_to_utf16() is passed 1 too large, an out-of-bounds read
occurs when dereferencing p_cstring in exfat_nls_to_ucs2() later.

And because of the NLS_NAME_OVERLEN macro, another error occurs when
creating a file with a period at the end using utf8 and other iocharsets.

So to avoid this, you should remove the code that uses NLS_NAME_OVERLEN
macro and make the len argument value be the length of the label string,
but with a maximum length of FSLABEL_MAX - 1.

Reported-by: syzbot+98cc76a76de46b3714d4@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=98cc76a76de46b3714d4
Fixes: d01579d590f7 ("exfat: Add support for FS_IOC_{GET,SET}FSLABEL")
Suggested-by: Pali Rohár <pali@kernel.org>
Signed-off-by: Jeongjun Park <aha310510@gmail.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>

diff --git a/fs/exfat/exfat_fs.h b/fs/exfat/exfat_fs.h
index 329697c89d0903103e61cd6b32d95d202d9c105c..38210fb6901c09c4dc04d10b5929840f28e93941 100644 (file)
--- a/fs/exfat/exfat_fs.h
+++ b/fs/exfat/exfat_fs.h
@@ -29,7 +29,6 @@ enum exfat_error_mode {
 enum {
        NLS_NAME_NO_LOSSY =     0,      /* no lossy */
        NLS_NAME_LOSSY =        1 << 0, /* just detected incorrect filename(s) */
-       NLS_NAME_OVERLEN =      1 << 1, /* the length is over than its limit */
 };
 
 #define EXFAT_HASH_BITS                8

diff --git a/fs/exfat/file.c b/fs/exfat/file.c
index f246cf439588db5982344cfdb26171daaa6da519..adc37b4d7fc2d0e69e96efc808aff2325ad6b7d2 100644 (file)
--- a/fs/exfat/file.c
+++ b/fs/exfat/file.c
@@ -509,8 +509,8 @@ static int exfat_ioctl_get_volume_label(struct super_block *sb, unsigned long ar
 static int exfat_ioctl_set_volume_label(struct super_block *sb,
                                        unsigned long arg)
 {
-       int ret = 0, lossy;
-       char label[FSLABEL_MAX];
+       int ret = 0, lossy, label_len;
+       char label[FSLABEL_MAX] = {0};
        struct exfat_uni_name uniname;
 
        if (!capable(CAP_SYS_ADMIN))
@@ -520,8 +520,9 @@ static int exfat_ioctl_set_volume_label(struct super_block *sb,
                return -EFAULT;
 
        memset(&uniname, 0, sizeof(uniname));
+       label_len = strnlen(label, FSLABEL_MAX - 1);
        if (label[0]) {
-               ret = exfat_nls_to_utf16(sb, label, FSLABEL_MAX,
+               ret = exfat_nls_to_utf16(sb, label, label_len,
                                         &uniname, &lossy);
                if (ret < 0)
                        return ret;

diff --git a/fs/exfat/namei.c b/fs/exfat/namei.c
index 2364b49f050a357e754221acfac74a7728556dbf..745dce29ddb532f7f4ca6d9aad5ddc8943aab4b5 100644 (file)
--- a/fs/exfat/namei.c
+++ b/fs/exfat/namei.c
@@ -442,7 +442,7 @@ static int __exfat_resolve_path(struct inode *inode, const unsigned char *path,
                return namelen; /* return error value */
 
        if ((lossy && !lookup) || !namelen)
-               return (lossy & NLS_NAME_OVERLEN) ? -ENAMETOOLONG : -EINVAL;
+               return -EINVAL;
 
        return 0;
 }

diff --git a/fs/exfat/nls.c b/fs/exfat/nls.c
index 8243d94ceaf47d34c28676128f7f333b5ebce7de..57db08a5271cf8c304a58fba37d67f8ceec9a9c7 100644 (file)
--- a/fs/exfat/nls.c
+++ b/fs/exfat/nls.c
@@ -616,9 +616,6 @@ static int exfat_nls_to_ucs2(struct super_block *sb,
                unilen++;
        }
 
-       if (p_cstring[i] != '\0')
-               lossy |= NLS_NAME_OVERLEN;
-
        *uniname = '\0';
        p_uniname->name_len = unilen;
        p_uniname->name_hash = exfat_calc_chksum16(upname, unilen << 1, 0,