[PATCH] exfat: fix reading a directory whose FAT chain is longer than its size

[PATCH] exfat: fix reading a directory whose FAT chain is longer than its size

[Hengyu Liang]

Commit 08cf4a8181b4 ("exfat: use exfat_chain_advance helper") made the
directory code walk the clusters of a directory with
exfat_chain_advance().

However, exfat_chain_advance() returns -EIO once it has walked as many
clusters as the size of the directory says. The FAT chain of a directory
can be longer than that, because some cameras stop updating the size,
see commit 1e5654de0f51 ("exfat: handle wrong stream entry size in
exfat_readdir()"). As of now, opening such a directory fails with EIO as
soon as the chain is two clusters longer than the size. Reading a
directory that has a FAT chain after a seek past its end fails with EIO
too.

The issue can be reproduced with an image in which the size of a
directory with 200 files and 7 clusters is lowered to 2 clusters:

    mount -o loop exfat.img /mnt
    ls /mnt/d | wc -l

Before commit 08cf4a8181b4 ("exfat: use exfat_chain_advance helper"),
the result is:

    200

After that commit, ls fails with "Input/output error" and the result is:

    0

This patch will make exfat_chain_advance() follow the FAT to its end
when the directory has a FAT chain, as the code did before, and keep the
size check for a directory without one.

Fixes: 08cf4a8181b4 ("exfat: use exfat_chain_advance helper")
Cc: stable@vger.kernel.org
Signed-off-by: Hengyu Liang <hengyul@cs.unc.edu>
---
 fs/exfat/exfat_fs.h | 28 +++++++++++++++++++---------
 1 file changed, 19 insertions(+), 9 deletions(-)

diff --git a/fs/exfat/exfat_fs.h b/fs/exfat/exfat_fs.h
index a9131fe03302..f324c4cba26a 100644
--- a/fs/exfat/exfat_fs.h
+++ b/fs/exfat/exfat_fs.h
@@ -623,19 +623,29 @@ static inline int exfat_chain_advance(struct super_block *sb,
 		struct exfat_chain *chain, unsigned int step)
 {
 	unsigned int clu = chain->dir;
+	unsigned int i;
 
-	if (unlikely(chain->size < step))
-		return -EIO;
+	if (chain->flags == ALLOC_NO_FAT_CHAIN) {
+		if (unlikely(chain->size < step))
+			return -EIO;
 
-	if (exfat_cluster_walk(sb, &clu, step, chain->flags))
-		return -EIO;
+		chain->size -= step;
+		chain->dir = chain->size ? clu + step : EXFAT_EOF_CLUSTER;
+		return 0;
+	}
 
-	chain->size -= step;
+	/*
+	 * Only the FAT tells where a chain of this kind ends. The size can be
+	 * smaller than the chain, see commit 1e5654de0f51 ("exfat: handle
+	 * wrong stream entry size in exfat_readdir()").
+	 */
+	for (i = 0; i < step && clu != EXFAT_EOF_CLUSTER; i++) {
+		if (exfat_get_next_cluster(sb, &clu))
+			return -EIO;
+	}
 
-	if (chain->size == 0 && chain->flags == ALLOC_NO_FAT_CHAIN)
-		chain->dir = EXFAT_EOF_CLUSTER;
-	else
-		chain->dir = clu;
+	chain->size -= min(chain->size, step);
+	chain->dir = clu;
 
 	return 0;
 }
-- 
2.53.0

Re: [PATCH] exfat: fix reading a directory whose FAT chain is longer than its size

[Chi Zhiling]

On 10/15/2026 10:49 PM, Hengyu Liang wrote:
> Commit 08cf4a8181b4 ("exfat: use exfat_chain_advance helper") made the
> directory code walk the clusters of a directory with
> exfat_chain_advance().
> 
> However, exfat_chain_advance() returns -EIO once it has walked as many
> clusters as the size of the directory says. The FAT chain of a directory
> can be longer than that, because some cameras stop updating the size,
> see commit 1e5654de0f51 ("exfat: handle wrong stream entry size in
> exfat_readdir()"). As of now, opening such a directory fails with EIO as
> soon as the chain is two clusters longer than the size. Reading a
> directory that has a FAT chain after a seek past its end fails with EIO
> too.
> 
> The issue can be reproduced with an image in which the size of a
> directory with 200 files and 7 clusters is lowered to 2 clusters:
> 
>      mount -o loop exfat.img /mnt
>      ls /mnt/d | wc -l
> 
> Before commit 08cf4a8181b4 ("exfat: use exfat_chain_advance helper"),
> the result is:
> 
>      200
> 
> After that commit, ls fails with "Input/output error" and the result is:
> 
>      0
> 
> This patch will make exfat_chain_advance() follow the FAT to its end
> when the directory has a FAT chain, as the code did before, and keep the
> size check for a directory without one.
> 
> Fixes: 08cf4a8181b4 ("exfat: use exfat_chain_advance helper")
> Cc: stable@vger.kernel.org
> Signed-off-by: Hengyu Liang <hengyul@cs.unc.edu>
> ---

Thanks for pointing out this bug.

Reviewed-by: Chi Zhiling <chizhiling@kylinos.cn>

Re: [PATCH] exfat: fix reading a directory whose FAT chain is longer than its size

[Namjae Jeon]

On Thu, Oct 15, 2026 at 11:49 PM Hengyu Liang <hengyul@cs.unc.edu> wrote:
>
> Commit 08cf4a8181b4 ("exfat: use exfat_chain_advance helper") made the
> directory code walk the clusters of a directory with
> exfat_chain_advance().
>
> However, exfat_chain_advance() returns -EIO once it has walked as many
> clusters as the size of the directory says. The FAT chain of a directory
> can be longer than that, because some cameras stop updating the size,
> see commit 1e5654de0f51 ("exfat: handle wrong stream entry size in
> exfat_readdir()"). As of now, opening such a directory fails with EIO as
> soon as the chain is two clusters longer than the size. Reading a
> directory that has a FAT chain after a seek past its end fails with EIO
> too.
>
> The issue can be reproduced with an image in which the size of a
> directory with 200 files and 7 clusters is lowered to 2 clusters:
>
>     mount -o loop exfat.img /mnt
>     ls /mnt/d | wc -l
>
> Before commit 08cf4a8181b4 ("exfat: use exfat_chain_advance helper"),
> the result is:
>
>     200
>
> After that commit, ls fails with "Input/output error" and the result is:
>
>     0
>
> This patch will make exfat_chain_advance() follow the FAT to its end
> when the directory has a FAT chain, as the code did before, and keep the
> size check for a directory without one.
>
> Fixes: 08cf4a8181b4 ("exfat: use exfat_chain_advance helper")
> Cc: stable@vger.kernel.org
> Signed-off-by: Hengyu Liang <hengyul@cs.unc.edu>
Applied it to #dev.
Thanks!