linux-stable.git/fs/exfat, branch linux-6.13.y

exfat: fix potential wrong error return from get_block

2025-04-10T12:42:05+00:00

commit 59c30e31425833385e6644ad33151420e37eabe1 upstream.

If there is no error, get_block() should return 0. However, when bh_read()
returns 1, get_block() also returns 1 in the same manner.

Let's set err to 0, if there is no error from bh_read()

Fixes: 11a347fb6cef ("exfat: change to get file size from DataLength")
Cc: stable@vger.kernel.org
Signed-off-by: Sungjong Seo 
Reviewed-by: Yuezhang Mo 
Signed-off-by: Namjae Jeon 
Signed-off-by: Greg Kroah-Hartman

exfat: fix random stack corruption after get_block

2025-04-10T12:42:05+00:00

commit 1bb7ff4204b6d4927e982cd256286c09ed4fd8ca upstream.

When get_block is called with a buffer_head allocated on the stack, such
as do_mpage_readpage, stack corruption due to buffer_head UAF may occur in
the following race condition situation.

                           
mpage_read_folio
  <>
  do_mpage_readpage
    exfat_get_block
      bh_read
        __bh_read
	  get_bh(bh)
          submit_bh
          wait_on_buffer
                              ...
                              end_buffer_read_sync
                                __end_buffer_read_notouch
                                   unlock_buffer
          <>
        ...
      ...
    ...
  ...
<>
   .
   .
another_function
  <>
                                   put_bh(bh)
                                     atomic_dec(bh->b_count)
  * stack corruption here *

This patch returns -EAGAIN if a folio does not have buffers when bh_read
needs to be called. By doing this, the caller can fallback to functions
like block_read_full_folio(), create a buffer_head in the folio, and then
call get_block again.

Let's do not call bh_read() with on-stack buffer_head.

Fixes: 11a347fb6cef ("exfat: change to get file size from DataLength")
Cc: stable@vger.kernel.org
Tested-by: Yeongjin Gil 
Signed-off-by: Sungjong Seo 
Reviewed-by: Yuezhang Mo 
Signed-off-by: Namjae Jeon 
Signed-off-by: Greg Kroah-Hartman

exfat: add a check for invalid data size

2025-04-10T12:41:54+00:00

[ Upstream commit 13940cef95491472760ca261b6713692ece9b946 ]

Add a check for invalid data size to avoid corrupted filesystem
from being further corrupted.

Signed-off-by: Yuezhang Mo 
Signed-off-by: Namjae Jeon 
Signed-off-by: Sasha Levin

exfat: fix missing shutdown check

2025-04-10T12:41:50+00:00

[ Upstream commit 47e35366bc6fa3cf189a8305bce63992495f3efa ]

xfstests generic/730 test failed because after deleting the device
that still had dirty data, the file could still be read without
returning an error. The reason is the missing shutdown check in
->read_iter.

I also noticed that shutdown checks were missing from ->write_iter,
->splice_read, and ->mmap. This commit adds shutdown checks to all
of them.

Fixes: f761fcdd289d ("exfat: Implement sops->shutdown and ioctl")
Signed-off-by: Yuezhang Mo 
Signed-off-by: Namjae Jeon 
Signed-off-by: Sasha Levin

exfat: fix the infinite loop in exfat_find_last_cluster()

2025-04-10T12:41:50+00:00

[ Upstream commit b0522303f67255926b946aa66885a0104d1b2980 ]

In exfat_find_last_cluster(), the cluster chain is traversed until
the EOF cluster. If the cluster chain includes a loop due to file
system corruption, the EOF cluster cannot be traversed, resulting
in an infinite loop.

If the number of clusters indicated by the file size is inconsistent
with the cluster chain length, exfat_find_last_cluster() will return
an error, so if this inconsistency is found, the traversal can be
aborted without traversing to the EOF cluster.

Reported-by: syzbot+f7d147e6db52b1e09dba@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=f7d147e6db52b1e09dba
Tested-by: syzbot+f7d147e6db52b1e09dba@syzkaller.appspotmail.com
Fixes: 31023864e67a ("exfat: add fat entry operations")
Signed-off-by: Yuezhang Mo 
Signed-off-by: Namjae Jeon 
Signed-off-by: Sasha Levin

exfat: short-circuit zero-byte writes in exfat_file_write_iter

2025-03-13T12:07:58+00:00

[ Upstream commit fda94a9919fd632033979ad7765a99ae3cab9289 ]

When generic_write_checks() returns zero, it means that
iov_iter_count() is zero, and there is no work to do.

Simply return success like all other filesystems do, rather than
proceeding down the write path, which today yields an -EFAULT in
generic_perform_write() via the
(fault_in_iov_iter_readable(i, bytes) == bytes) check when bytes
== 0.

Fixes: 11a347fb6cef ("exfat: change to get file size from DataLength")
Reported-by: Noah 
Signed-off-by: Eric Sandeen 
Reviewed-by: Yuezhang Mo 
Signed-off-by: Namjae Jeon 
Signed-off-by: Sasha Levin

exfat: fix soft lockup in exfat_clear_bitmap

2025-03-13T12:07:58+00:00

[ Upstream commit 9da33619e0ca53627641bc97d1b93ec741299111 ]

bitmap clear loop will take long time in __exfat_free_cluster()
if data size of file/dir enty is invalid.
If cluster bit in bitmap is already clear, stop clearing bitmap go to
out of loop.

Fixes: 31023864e67a ("exfat: add fat entry operations")
Reported-by: Kun Hu , Jiaji Qin 
Reviewed-by: Sungjong Seo 
Signed-off-by: Namjae Jeon 
Signed-off-by: Sasha Levin

exfat: fix just enough dentries but allocate a new cluster to dir

2025-03-13T12:07:58+00:00

[ Upstream commit 6697f819a10b238ccf01998c3f203d65d8374696 ]

This commit fixes the condition for allocating cluster to parent
directory to avoid allocating new cluster to parent directory when
there are just enough empty directory entries at the end of the
parent directory.

Fixes: af02c72d0b62 ("exfat: convert exfat_find_empty_entry() to use dentry cache")
Signed-off-by: Yuezhang Mo 
Signed-off-by: Namjae Jeon 
Signed-off-by: Sasha Levin

exfat: fix the infinite loop in __exfat_free_cluster()

2024-12-31T08:51:21+00:00

In __exfat_free_cluster(), the cluster chain is traversed until the
EOF cluster. If the cluster chain includes a loop due to file system
corruption, the EOF cluster cannot be traversed, resulting in an
infinite loop.

This commit uses the total number of clusters to prevent this infinite
loop.

Reported-by: syzbot+1de5a37cb85a2d536330@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=1de5a37cb85a2d536330
Tested-by: syzbot+1de5a37cb85a2d536330@syzkaller.appspotmail.com
Fixes: 31023864e67a ("exfat: add fat entry operations")
Signed-off-by: Yuezhang Mo 
Reviewed-by: Sungjong Seo 
Signed-off-by: Namjae Jeon

exfat: fix the new buffer was not zeroed before writing

2024-12-31T08:51:16+00:00

Before writing, if a buffer_head marked as new, its data must
be zeroed, otherwise uninitialized data in the page cache will
be written.

So this commit uses folio_zero_new_buffers() to zero the new
buffers before ->write_end().

Fixes: 6630ea49103c ("exfat: move extend valid_size into ->page_mkwrite()")
Reported-by: syzbot+91ae49e1c1a2634d20c0@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=91ae49e1c1a2634d20c0
Tested-by: syzbot+91ae49e1c1a2634d20c0@syzkaller.appspotmail.com
Signed-off-by: Yuezhang Mo 
Reviewed-by: Sungjong Seo 
Signed-off-by: Namjae Jeon