Re: [PATCH] exfat: fix reading a directory whose FAT chain is longer than its size

[Chi Zhiling]

On 10/15/2026 10:49 PM, Hengyu Liang wrote:
> Commit 08cf4a8181b4 ("exfat: use exfat_chain_advance helper") made the
> directory code walk the clusters of a directory with
> exfat_chain_advance().
>
> However, exfat_chain_advance() returns -EIO once it has walked as many
> clusters as the size of the directory says. The FAT chain of a directory
> can be longer than that, because some cameras stop updating the size,
> see commit 1e5654de0f51 ("exfat: handle wrong stream entry size in
> exfat_readdir()"). As of now, opening such a directory fails with EIO as
> soon as the chain is two clusters longer than the size. Reading a
> directory that has a FAT chain after a seek past its end fails with EIO
> too.
>
> The issue can be reproduced with an image in which the size of a
> directory with 200 files and 7 clusters is lowered to 2 clusters:
>
>      mount -o loop exfat.img /mnt
>      ls /mnt/d | wc -l
>
> Before commit 08cf4a8181b4 ("exfat: use exfat_chain_advance helper"),
> the result is:
>
>      200
>
> After that commit, ls fails with "Input/output error" and the result is:
>
>      0
>
> This patch will make exfat_chain_advance() follow the FAT to its end
> when the directory has a FAT chain, as the code did before, and keep the
> size check for a directory without one.
>
> Fixes: 08cf4a8181b4 ("exfat: use exfat_chain_advance helper")
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Hengyu Liang <hengyul@xxxxxxxxxx>
> ---

Thanks for pointing out this bug.

Reviewed-by: Chi Zhiling <chizhiling@xxxxxxxxxx>