Commit 95d96e3e authored by Yuezhang Mo's avatar Yuezhang Mo Committed by Cai Xinchen
Browse files

exfat: fix the infinite loop in exfat_readdir() 

stable inclusion
from stable-v6.6.72
commit dc1d7afceb982e8f666e70a582e6b5aa806de063
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBJ6S6
CVE: CVE-2024-57940

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=dc1d7afceb982e8f666e70a582e6b5aa806de063



--------------------------------

[ Upstream commit fee873761bd978d077d8c55334b4966ac4cb7b59 ]

If the file system is corrupted so that a cluster is linked to
itself in the cluster chain, and there is an unused directory
entry in the cluster, 'dentry' will not be incremented, causing
condition 'dentry < max_dentries' unable to prevent an infinite
loop.

This infinite loop causes s_lock not to be released, and other
tasks will hang, such as exfat_sync_fs().

This commit stops traversing the cluster chain when there is unused
directory entry in the cluster to avoid this infinite loop.

Reported-by: default avatar <syzbot+205c2644abdff9d3f9fc@syzkaller.appspotmail.com>
Closes: https://syzkaller.appspot.com/bug?extid=205c2644abdff9d3f9fc


Tested-by: default avatar <syzbot+205c2644abdff9d3f9fc@syzkaller.appspotmail.com>
Fixes: ca061973 ("exfat: add directory operations")
Signed-off-by: default avatarYuezhang Mo <Yuezhang.Mo@sony.com>
Reviewed-by: default avatarSungjong Seo <sj1557.seo@samsung.com>
Signed-off-by: default avatarNamjae Jeon <linkinjeon@kernel.org>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
Signed-off-by: default avatarCai Xinchen <caixinchen1@huawei.com>
parent 30472c94

fs/exfat/dir.c

+2 −1
Original line number Diff line number Diff line
@@ -125,7 +125,7 @@ static int exfat_readdir(struct inode *inode, loff_t *cpos, struct exfat_dir_ent 
			type = exfat_get_entry_type(ep);

			if (type == TYPE_UNUSED) {

				brelse(bh);

				break;

				goto out;

			}



			if (type != TYPE_FILE && type != TYPE_DIR) {
@@ -189,6 +189,7 @@ static int exfat_readdir(struct inode *inode, loff_t *cpos, struct exfat_dir_ent 
		}

	}



out:

	dir_entry->namebuf.lfn[0] = '\0';

	*cpos = EXFAT_DEN_TO_B(dentry);

	return 0;