[lkml]   [2020]   [Jun]   [29]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
Patch in this message
Subject[PATCH] fs: fat: add check for dir size in fat_calc_dir_size
Max directory size of FAT filesystem is FAT_MAX_DIR_SIZE(2097152 bytes)
It is possible that, due to corruption, directory size calculated in
fat_calc_dir_size() can be greater than FAT_MAX_DIR_SIZE, i.e.
can be in GBs, hence directory traversal can take long time.
for example when command "ls -lR" is executed on corrupted FAT
formatted USB, fat_search_long() function will lookup for a filename from
position 0 till end of corrupted directory size, multiple such lookups
will lead to long directory traversal

Added sanity check for directory size fat_calc_dir_size(),
and return EIO error, which will prevent lookup in corrupted directory

Signed-off-by: Anupam Aggarwal <>
Signed-off-by: Amit Sahrawat <>
fs/fat/inode.c | 7 +++++++
1 file changed, 7 insertions(+)

diff --git a/fs/fat/inode.c b/fs/fat/inode.c
index a0cf99d..9b2e81e 100644
--- a/fs/fat/inode.c
+++ b/fs/fat/inode.c
@@ -490,6 +490,13 @@ static int fat_calc_dir_size(struct inode *inode)
return ret;
inode->i_size = (fclus + 1) << sbi->cluster_bits;

+ if (i_size_read(inode) > FAT_MAX_DIR_SIZE) {
+ fat_fs_error(inode->i_sb,
+ "%s corrupted directory (invalid size %lld)\n",
+ __func__, i_size_read(inode));
+ return -EIO;
+ }
return 0;

 \ /
  Last update: 2020-06-29 21:20    [W:0.154 / U:5.124 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site