]> git.ipfire.org Git - thirdparty/kernel/stable.git/commit
exfat: fix the infinite loop in exfat_readdir()
authorYuezhang Mo <Yuezhang.Mo@sony.com>
Fri, 13 Dec 2024 05:08:37 +0000 (13:08 +0800)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Fri, 17 Jan 2025 12:34:37 +0000 (13:34 +0100)
commit31beabd0f47f8c3ed9965ba861c9e5b252d4920a
tree7f0eb4536e96c9b70639a6265b539152da03ef5f
parent43c38c3b73e936bd4259872e61d9adcc60d2bd8e
exfat: fix the infinite loop in exfat_readdir()

[ Upstream commit fee873761bd978d077d8c55334b4966ac4cb7b59 ]

If the file system is corrupted so that a cluster is linked to
itself in the cluster chain, and there is an unused directory
entry in the cluster, 'dentry' will not be incremented, causing
condition 'dentry < max_dentries' unable to prevent an infinite
loop.

This infinite loop causes s_lock not to be released, and other
tasks will hang, such as exfat_sync_fs().

This commit stops traversing the cluster chain when there is unused
directory entry in the cluster to avoid this infinite loop.

Reported-by: syzbot+205c2644abdff9d3f9fc@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=205c2644abdff9d3f9fc
Tested-by: syzbot+205c2644abdff9d3f9fc@syzkaller.appspotmail.com
Fixes: ca06197382bd ("exfat: add directory operations")
Signed-off-by: Yuezhang Mo <Yuezhang.Mo@sony.com>
Reviewed-by: Sungjong Seo <sj1557.seo@samsung.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
fs/exfat/dir.c