[PATCH] exfat: fix upcase table validation to require all entries consumed

[Reid Downing]

exfat_load_upcase_table() and exfat_load_default_upcase_table()
accept the table when index >= 0xFFFF, but a correct table must
process all 0x10000 entries, leaving index at 0x10000.

a crafted filesystem image can use the compressed skip encoding
to advance index to exactly 0xFFFF without filling the remaining
entries. the checksum covers only the on-disk bytes so it can be
made to match. the kernel accepts the table while the unfilled
entries silently remain zero, causing incorrect uppercase mappings
for the affected codepoints and breaking case-insensitive filename
comparison for non-ascii characters.

fix both checks to require index >= UTBL_COUNT.

Fixes: 370e812b3ec1 ("exfat: add nls operations")
Signed-off-by: Reid Downing <skibletz@xxxxxxxxx>
---
 fs/exfat/nls.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/fs/exfat/nls.c b/fs/exfat/nls.c
index 055447edc..7afc86ea2 100644
--- a/fs/exfat/nls.c
+++ b/fs/exfat/nls.c
@@ -691,7 +691,7 @@ static int exfat_load_upcase_table(struct super_block *sb,
 		brelse(bh);
 	}
 
-	if (index >= 0xFFFF && utbl_checksum == chksum)
+	if (index >= UTBL_COUNT && utbl_checksum == chksum)
 		return 0;
 
 	exfat_err(sb, "failed to load upcase table (idx : 0x%08x, chksum : 0x%08x, utbl_chksum : 0x%08x)",
@@ -728,7 +728,7 @@ static int exfat_load_default_upcase_table(struct super_block *sb)
 		}
 	}
 
-	if (index >= 0xFFFF)
+	if (index >= UTBL_COUNT)
 		return 0;
 
 	/* FATAL error: default upcase table has error */
-- 
2.53.0