From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail.parknet.co.jp (mail.parknet.co.jp [210.171.160.6]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 0CBFC305678 for ; Wed, 10 Jun 2026 06:25:24 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=210.171.160.6 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781072727; cv=none; b=BB+X8pq76WS+2GSVKdDf7DmqlpWZCneOd/CKkU2iSlvWICacraV5To3ptFvuHhe2eKDN/ldB9bFyRW+882gALn0kJA/JpyK7mVQm/vnKuKS0FGcosrUvivzjlhohPXRr45DQO3lF5Nm0nmr/A8AOr2jfUoA4PwnW/FB6dtD/ItY= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781072727; c=relaxed/simple; bh=RKPMj8p4Kchtk8See22AE+JrCHuV0Jql+vcCnkdsUnU=; h=From:To:Cc:Subject:In-Reply-To:References:Date:Message-ID: MIME-Version:Content-Type; b=gAdNvm31OyBS9oINRbO0CzsH7/UxWGfksrQp+oo/gH22ShrvCy4Tv5fGLWfdPGkCZ7GzNar0mkn7aJqGj5A0mF6ELHV5l/x9lZJ03T3QeaUiOzPu8FeSiQoo6ilvNacMlfYPuspX8e04Iuuzve3Bm5HX8QWDVBR93S5WW82ZGwQ= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=mail.parknet.co.jp; spf=pass smtp.mailfrom=parknet.co.jp; dkim=pass (2048-bit key) header.d=parknet.co.jp header.i=@parknet.co.jp header.b=g4BPBznP; dkim=permerror (0-bit key) header.d=parknet.co.jp header.i=@parknet.co.jp header.b=zSyzs39S; arc=none smtp.client-ip=210.171.160.6 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=mail.parknet.co.jp Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=parknet.co.jp Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=parknet.co.jp header.i=@parknet.co.jp header.b="g4BPBznP"; dkim=permerror (0-bit key) header.d=parknet.co.jp header.i=@parknet.co.jp header.b="zSyzs39S" Received: from ibmpc.myhome.or.jp (server.parknet.ne.jp [210.171.168.39]) by mail.parknet.co.jp (Postfix) with ESMTPSA id 130EE26F765F; Wed, 10 Jun 2026 15:25:17 +0900 (JST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=parknet.co.jp; s=20250114; t=1781072717; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: in-reply-to:in-reply-to:references:references; bh=I4BFsu5bs8snXaODqRLOZjQD/F0H3T4vJrHp13IkclE=; b=g4BPBznPGd9dHFoppAzDokEmMmjon/DwehijmlrPB50PC0I/Zenn8ag9D4NrYlmjLtQtSL kQl9o5IknGQURDFtTdavOP4Pje0vB7SQkqp06gq/9ynSRc8R8n/pYX6C9WMvGmbtKrGLm5 5t1/JDCVFyJx6WhRjbgj81S0CJe2pnn/sTBVmFqj+MS8+mvy7boKPDDHfmf/N9oe19dE+W PpthxOeQB5QjzeQkIVHMRloEd2S9ztRHv1gyz0rfXQRr7G/oJTxhxIiGOfVvFAaRx80gY4 rQgyRbtyLgu8dr1JwZaDcs3dig1g1LLGANsHgsmmO3XLO6lL/5Ew43Ixhygbyg== DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=parknet.co.jp; s=20250114-ed25519; t=1781072717; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: in-reply-to:in-reply-to:references:references; bh=I4BFsu5bs8snXaODqRLOZjQD/F0H3T4vJrHp13IkclE=; b=zSyzs39STnlZdTWCpuWf4+j5NQYK4LcbreO+14pGoblmxYv7w23cNFP1Hq0Tuom89Gmb0j wm2YsoYL2Arh1qCg== Received: from devron.myhome.or.jp (devron.myhome.or.jp [192.168.0.3]) by ibmpc.myhome.or.jp (Postfix) with ESMTPS id 965BBE008A9; Wed, 10 Jun 2026 15:25:16 +0900 (JST) Received: by devron.myhome.or.jp (Postfix, from userid 1000) id 8D36422001D5; Wed, 10 Jun 2026 15:25:16 +0900 (JST) From: OGAWA Hirofumi To: Andrew Morton Cc: Samuel Moelius , linux-kernel@vger.kernel.org (open list) Subject: Re: [PATCH] fat: reject BPB volumes whose data area starts beyond total sectors In-Reply-To: <20260605155216.2126545-1-sam.moelius@trailofbits.com> References: <20260605155216.2126545-1-sam.moelius@trailofbits.com> Date: Wed, 10 Jun 2026 15:25:16 +0900 Message-ID: <87v7bqhpyr.fsf@mail.parknet.co.jp> User-Agent: Gnus/5.13 (Gnus v5.13) Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain Samuel Moelius writes: > fat_fill_super() subtracts sbi->data_start from the BPB total sector > count before computing the number of clusters. A malformed image can > declare a total sector count smaller than data_start, causing the > subtraction to underflow and the mount code to derive a plausible > cluster count from the FAT length instead. > > Reject such images before the subtraction. In QEMU, a crafted FAT image > with total_sectors=2 and data_start=3 mounted successfully before the > fix and reading a file returned bytes stored past the BPB-declared end > of the volume. With this change, the same image is rejected during > mount. > > Assisted-by: Codex:gpt-5.5-cyber-preview > Signed-off-by: Samuel Moelius Acked-by: OGAWA Hirofumi > --- > fs/fat/inode.c | 8 ++++++++ > 1 file changed, 8 insertions(+) > > diff --git a/fs/fat/inode.c b/fs/fat/inode.c > index 28f78df086ef..168a278cc60c 100644 > --- a/fs/fat/inode.c > +++ b/fs/fat/inode.c > @@ -1738,6 +1738,14 @@ int fat_fill_super(struct super_block *sb, struct fs_context *fc, > if (total_sectors == 0) > total_sectors = bpb.fat_total_sect; > > + if (total_sectors < sbi->data_start) { > + if (!silent) > + fat_msg(sb, KERN_ERR, > + "data area starts beyond volume (%lu > %u)", > + sbi->data_start, total_sectors); > + goto out_invalid; > + } > + > total_clusters = (total_sectors - sbi->data_start) / sbi->sec_per_clus; > > if (!is_fat32(sbi)) -- OGAWA Hirofumi