From 41cee75c184bcc9fb7b36335551d4d3e77473ea6 Mon Sep 17 00:00:00 2001 From: sunyue5 Date: Thu, 7 Jun 2018 09:22:45 +0800 Subject: [PATCH] exfat: avoid uniname accessing invalid address In exfat_find_dir_entry, if there doesn't have a TYPE_STREAM(0xc0) entry before TYPE_EXTEND(0xc1), it will cause kernel panic for the kernel poniter uniname accessing invalid address Propogated from OMR1. Change-Id: Ic8063eafc1c458c96c18a96d58dacd8f33695bb2 Signed-off-by: sunyue5 Reviewed-on: https://gerrit.mot.com/1235768 SLTApproved: Slta Waiver SME-Granted: SME Approvals Granted Tested-by: Jira Key Reviewed-by: Yue Sun Reviewed-by: Konstantin Makariev Submit-Approved: Jira Key Signed-off-by: yuedl1 Reviewed-on: https://gerrit.mot.com/1290985 Reviewed-by: Shi-Yong Li Reviewed-by: Zhenxin Xi --- fs/exfat/exfat_core.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/fs/exfat/exfat_core.c b/fs/exfat/exfat_core.c index 606f9e902843..9fb6b84f2848 100644 --- a/fs/exfat/exfat_core.c +++ b/fs/exfat/exfat_core.c @@ -3733,6 +3733,8 @@ s32 fat_find_dir_entry(struct super_block *sb, CHAIN_T *p_dir, UNI_NAME_T *p_uni if (ext_ep->order > 0x40) { order = (s32)(ext_ep->order - 0x40); uniname = p_uniname->name + 13 * (order-1); + } else if (uniname == NULL) { + return -2; } else { order = (s32) ext_ep->order; uniname -= 13; @@ -3861,6 +3863,8 @@ s32 exfat_find_dir_entry(struct super_block *sb, CHAIN_T *p_dir, UNI_NAME_T *p_u if ((++order) == 2) uniname = p_uniname->name; + else if (uniname == NULL) + return -2; else uniname += 15;