[PATCH] fat: reject BPB volumes whose data area starts beyond total sectors

[PATCH] fat: reject BPB volumes whose data area starts beyond total sectors

[Samuel Moelius]

fat_fill_super() subtracts sbi->data_start from the BPB total sector
count before computing the number of clusters.  A malformed image can
declare a total sector count smaller than data_start, causing the
subtraction to underflow and the mount code to derive a plausible
cluster count from the FAT length instead.

Reject such images before the subtraction.  In QEMU, a crafted FAT image
with total_sectors=2 and data_start=3 mounted successfully before the
fix and reading a file returned bytes stored past the BPB-declared end
of the volume.  With this change, the same image is rejected during
mount.

Assisted-by: Codex:gpt-5.5-cyber-preview
Signed-off-by: Samuel Moelius <sam.moelius@trailofbits.com>
---
 fs/fat/inode.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/fs/fat/inode.c b/fs/fat/inode.c
index 28f78df086ef..168a278cc60c 100644
--- a/fs/fat/inode.c
+++ b/fs/fat/inode.c
@@ -1738,6 +1738,14 @@ int fat_fill_super(struct super_block *sb, struct fs_context *fc,
 	if (total_sectors == 0)
 		total_sectors = bpb.fat_total_sect;
 
+	if (total_sectors < sbi->data_start) {
+		if (!silent)
+			fat_msg(sb, KERN_ERR,
+				"data area starts beyond volume (%lu > %u)",
+				sbi->data_start, total_sectors);
+		goto out_invalid;
+	}
+
 	total_clusters = (total_sectors - sbi->data_start) / sbi->sec_per_clus;
 
 	if (!is_fat32(sbi))
-- 
2.43.0

Re: [PATCH] fat: reject BPB volumes whose data area starts beyond total sectors

[OGAWA Hirofumi]

Samuel Moelius <sam.moelius@trailofbits.com> writes:

> fat_fill_super() subtracts sbi->data_start from the BPB total sector
> count before computing the number of clusters.  A malformed image can
> declare a total sector count smaller than data_start, causing the
> subtraction to underflow and the mount code to derive a plausible
> cluster count from the FAT length instead.
>
> Reject such images before the subtraction.  In QEMU, a crafted FAT image
> with total_sectors=2 and data_start=3 mounted successfully before the
> fix and reading a file returned bytes stored past the BPB-declared end
> of the volume.  With this change, the same image is rejected during
> mount.
>
> Assisted-by: Codex:gpt-5.5-cyber-preview
> Signed-off-by: Samuel Moelius <sam.moelius@trailofbits.com>

Acked-by: OGAWA Hirofumi <hirofumi@mail.parknet.co.jp>

> ---
>  fs/fat/inode.c | 8 ++++++++
>  1 file changed, 8 insertions(+)
>
> diff --git a/fs/fat/inode.c b/fs/fat/inode.c
> index 28f78df086ef..168a278cc60c 100644
> --- a/fs/fat/inode.c
> +++ b/fs/fat/inode.c
> @@ -1738,6 +1738,14 @@ int fat_fill_super(struct super_block *sb, struct fs_context *fc,
>  	if (total_sectors == 0)
>  		total_sectors = bpb.fat_total_sect;
>  
> +	if (total_sectors < sbi->data_start) {
> +		if (!silent)
> +			fat_msg(sb, KERN_ERR,
> +				"data area starts beyond volume (%lu > %u)",
> +				sbi->data_start, total_sectors);
> +		goto out_invalid;
> +	}
> +
>  	total_clusters = (total_sectors - sbi->data_start) / sbi->sec_per_clus;
>  
>  	if (!is_fat32(sbi))

-- 
OGAWA Hirofumi <hirofumi@mail.parknet.co.jp>