Date: Tue, 30 Aug 2005 11:13:18 -0700 (PDT) From: Nate Eldredge <nge@cs.hmc.edu> To: FreeBSD-gnats-submit@FreeBSD.org Subject: bin/85494: fsck_ffs: unchecked use of cg_inosused macro etc. Message-ID: <200508301813.j7UIDIAw020515@mercury.lan> Resent-Message-ID: <200508301830.j7UIULPb075302@freefall.freebsd.org>
next in thread | raw e-mail | index | archive | help
>Number: 85494 >Category: bin >Synopsis: fsck_ffs: unchecked use of cg_inosused macro etc. >Confidential: no >Severity: non-critical >Priority: medium >Responsible: freebsd-bugs >State: open >Quarter: >Keywords: >Date-Required: >Class: sw-bug >Submitter-Id: current-users >Arrival-Date: Tue Aug 30 18:30:21 GMT 2005 >Closed-Date: >Last-Modified: >Originator: Nate Eldredge >Release: FreeBSD 5.4-RELEASE-p3 i386 >Organization: >Environment: System: FreeBSD mercury.lan 5.4-RELEASE-p3 FreeBSD 5.4-RELEASE-p3 #1: Wed Jun 29 18:04:58 PDT 2005 nate@mercury.lan:/medium/obj/medium/src/sys/MERCURY i386 >Description: When fsck_ffs is checking a file system, one of the passes is to check the cylinder groups and see if the various bitmaps are correct. For example, on line 325 of pass5.c it looks at cg_inosused(cg). cg has been read from the disk, and cg_inosused is a pointer to cg->cg_iusedoff bytes past cg. (Defined in <ufs/ffs/fs.h>.) Presumably the inosused bitmap is supposed to be in the same block as the cg structure. However, if the cylinder group header is corrupt, cg->cg_iusedoff could be anything and thus cg_inosused(cg) will be a bogus pointer, and fsck_ffs will crash. Possibly there is no reasonable way for fsck_ffs to handle such corruption, but it still shouldn't segfault IMHO. Other uses of the cg_* macros are also suspect, and there may be other errors of the same sort throughout fsck. dumpfs has similar bugs. >How-To-Repeat: I have a filesystem image which crashes fsck_ffs because of this bug. However, the image is 1G and may contain some sensitive data (it's a corrupt /var) so I would rather not make it available. I can try to explain the problem further if necessary. >Fix: Check cg->iusedoff for sanity before trying to use it. For instance, make sure it points within the block that's been read from the disk. >Release-Note: >Audit-Trail: >Unformatted:
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200508301813.j7UIDIAw020515>