]> git.ipfire.org Git - thirdparty/kernel/linux.git/commit
exfat: fix improper check of dentry.stream.valid_size
authorJaehun Gou <p22gone@gmail.com>
Tue, 14 Oct 2025 13:01:46 +0000 (22:01 +0900)
committerNamjae Jeon <linkinjeon@kernel.org>
Wed, 15 Oct 2025 05:37:21 +0000 (14:37 +0900)
commit82ebecdc74ff555daf70b811d854b1f32a296bea
tree977beda498b5701baad37548abffef3edecfb900
parent9b332cece987ee1790b2ed4c989e28162fa47860
exfat: fix improper check of dentry.stream.valid_size

We found an infinite loop bug in the exFAT file system that can lead to a
Denial-of-Service (DoS) condition. When a dentry in an exFAT filesystem is
malformed, the following system calls — SYS_openat, SYS_ftruncate, and
SYS_pwrite64 — can cause the kernel to hang.

Root cause analysis shows that the size validation code in exfat_find()
does not check whether dentry.stream.valid_size is negative. As a result,
the system calls mentioned above can succeed and eventually trigger the DoS
issue.

This patch adds a check for negative dentry.stream.valid_size to prevent
this vulnerability.

Co-developed-by: Seunghun Han <kkamagui@gmail.com>
Signed-off-by: Seunghun Han <kkamagui@gmail.com>
Co-developed-by: Jihoon Kwon <jimmyxyz010315@gmail.com>
Signed-off-by: Jihoon Kwon <jimmyxyz010315@gmail.com>
Signed-off-by: Jaehun Gou <p22gone@gmail.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
fs/exfat/namei.c