exfat: tighten down num_fats check
diff mbox series

Message ID 89603.1581722921@turing-police
State New
Headers show
Series
  • exfat: tighten down num_fats check
Related show

Commit Message

Valdis Kl ē tnieks Feb. 14, 2020, 11:28 p.m. UTC
Change the test for num_fats from != 0 to a check for specifically 1.

Although it's theoretically possible that num_fats == 2 for a TexFAT volume (or
an implementation that doesn't do the full TexFAT but does support 2 FAT
tables), the rest of the code doesn't currently DTRT if it's 2 (in particular,
not handling the case of ActiveFat pointing at the second FAT area), so we'll
disallow that as well, as well as dealing with corrupted images that have a
trash non-zero value.

Signed-off-by: Valdis Kletnieks <valdis.kletnieks@vt.edu>

Comments

Namjae Jeon Feb. 17, 2020, 12:37 a.m. UTC | #1
> Change the test for num_fats from != 0 to a check for specifically 1.
> 
> Although it's theoretically possible that num_fats == 2 for a TexFAT
> volume (or an implementation that doesn't do the full TexFAT but does
> support 2 FAT tables), the rest of the code doesn't currently DTRT if it's
> 2 (in particular, not handling the case of ActiveFat pointing at the
> second FAT area), so we'll disallow that as well, as well as dealing with
> corrupted images that have a trash non-zero value.
> 
> Signed-off-by: Valdis Kletnieks <valdis.kletnieks@vt.edu>
> 
> --- a/fs/exfat/super.c	2020-02-14 17:45:02.262274632 -0500
> +++ b/fs/exfat/super.c	2020-02-14 17:46:37.200343723 -0500
> @@ -450,7 +450,7 @@ static int __exfat_fill_super(struct sup
>  	}
> 
>  	p_bpb = (struct pbr64 *)p_pbr;
> -	if (!p_bpb->bsx.num_fats) {
> +	if (p_bpb->bsx.num_fats  != 1) {
>  		exfat_msg(sb, KERN_ERR, "bogus number of FAT structure");
Could you please update error message for the reason why num_fats is allowed
only 1?
>  		ret = -EINVAL;
>  		goto free_bh;
Let's remove exfat_mirror_bh(), FAT2_start_sector variable and the below
related codes together.

sbi->FAT2_start_sector = p_bpb->bsx.num_fats == 1 ?
                sbi->FAT1_start_sector :
                        sbi->FAT1_start_sector + sbi->num_FAT_sectors;

Thanks for your patch!
> 
> 
> 
>
Valdis Kl ē tnieks Feb. 17, 2020, 1:41 a.m. UTC | #2
On Mon, 17 Feb 2020 09:37:55 +0900, "Namjae Jeon" said:

> Could you please update error message for the reason why num_fats is allowed
> only 1?

Sure.. No problem..

> >  		ret = -EINVAL;
> >  		goto free_bh;
> Let's remove exfat_mirror_bh(), FAT2_start_sector variable and the below
> related codes together.
>
> sbi->FAT2_start_sector = p_bpb->bsx.num_fats == 1 ?
>                 sbi->FAT1_start_sector :
>                         sbi->FAT1_start_sector + sbi->num_FAT_sectors;

You might want to hold off on that part for a bit - I've asked Sasha Levin for
input on what exactly Windows does with this, and Pali has a not-obviously-wrong
suggestion on using the second FAT table.  The code tracking FAT2_start_sector
looks OK - what would be missing is doing a similar versioning on the FAT
the rest of the code references.

We may end up heaving that code over the side in the end, but let's make
sure we're doing it with more information in hand....

Patch
diff mbox series

--- a/fs/exfat/super.c	2020-02-14 17:45:02.262274632 -0500
+++ b/fs/exfat/super.c	2020-02-14 17:46:37.200343723 -0500
@@ -450,7 +450,7 @@  static int __exfat_fill_super(struct sup
 	}

 	p_bpb = (struct pbr64 *)p_pbr;
-	if (!p_bpb->bsx.num_fats) {
+	if (p_bpb->bsx.num_fats  != 1) {
 		exfat_msg(sb, KERN_ERR, "bogus number of FAT structure");
 		ret = -EINVAL;
 		goto free_bh;