From: Namjae Jeon Date: Sat, 26 Oct 2024 04:06:15 +0000 (+0900) Subject: exfat: fix uninit-value in __exfat_get_dentry_set X-Git-Tag: v6.11.11~147 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=351e6904f11f216948c5f63878e9dd7aa77810e9;p=thirdparty%2Fkernel%2Fstable.git exfat: fix uninit-value in __exfat_get_dentry_set commit 02dffe9ab092fc4c8800aee68cb7eafd37a980c4 upstream. There is no check if stream size and start_clu are invalid. If start_clu is EOF cluster and stream size is 4096, It will cause uninit value access. because ei->hint_femp.eidx could be 128(if cluster size is 4K) and wrong hint will allocate next cluster. and this cluster will be same with the cluster that is allocated by exfat_extend_valid_size(). The previous patch will check invalid start_clu, but for clarity, initialize hint_femp.eidx to zero. Cc: stable@vger.kernel.org Reported-by: syzbot+01218003be74b5e1213a@syzkaller.appspotmail.com Tested-by: syzbot+01218003be74b5e1213a@syzkaller.appspotmail.com Reviewed-by: Yuezhang Mo Signed-off-by: Namjae Jeon Signed-off-by: Greg Kroah-Hartman --- diff --git a/fs/exfat/namei.c b/fs/exfat/namei.c index 631ad9e8e32a9..9ae2a3d6cfe20 100644 --- a/fs/exfat/namei.c +++ b/fs/exfat/namei.c @@ -345,6 +345,7 @@ static int exfat_find_empty_entry(struct inode *inode, if (ei->start_clu == EXFAT_EOF_CLUSTER) { ei->start_clu = clu.dir; p_dir->dir = clu.dir; + hint_femp.eidx = 0; } /* append to the FAT chain */