Commit 82ebecdc authored by Jaehun Gou's avatar Jaehun Gou Committed by Namjae Jeon
Browse files

exfat: fix improper check of dentry.stream.valid_size



We found an infinite loop bug in the exFAT file system that can lead to a
Denial-of-Service (DoS) condition. When a dentry in an exFAT filesystem is
malformed, the following system calls — SYS_openat, SYS_ftruncate, and
SYS_pwrite64 — can cause the kernel to hang.

Root cause analysis shows that the size validation code in exfat_find()
does not check whether dentry.stream.valid_size is negative. As a result,
the system calls mentioned above can succeed and eventually trigger the DoS
issue.

This patch adds a check for negative dentry.stream.valid_size to prevent
this vulnerability.

Co-developed-by: default avatarSeunghun Han <kkamagui@gmail.com>
Signed-off-by: default avatarSeunghun Han <kkamagui@gmail.com>
Co-developed-by: default avatarJihoon Kwon <jimmyxyz010315@gmail.com>
Signed-off-by: default avatarJihoon Kwon <jimmyxyz010315@gmail.com>
Signed-off-by: default avatarJaehun Gou <p22gone@gmail.com>
Signed-off-by: default avatarNamjae Jeon <linkinjeon@kernel.org>
parent 9b332cec
Loading
Loading
Loading
Loading
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Please to comment