Date: Wed, 17 Jul 2002 09:53:25 -0700 (PDT) From: Eric Jacobs <eaja@erols.com> To: freebsd-gnats-submit@FreeBSD.org Subject: bin/40697: fsck[_ffs](8) doesn't ensure that (signed) cylinder group rotor values are non-negative Message-ID: <200207171653.g6HGrPTB050679@www.freebsd.org>
next in thread | raw e-mail | index | archive | help
>Number: 40697 >Category: bin >Synopsis: fsck[_ffs](8) doesn't ensure that (signed) cylinder group rotor values are non-negative >Confidential: no >Severity: serious >Priority: low >Responsible: freebsd-bugs >State: open >Quarter: >Keywords: >Date-Required: >Class: sw-bug >Submitter-Id: current-users >Arrival-Date: Wed Jul 17 10:00:05 PDT 2002 >Closed-Date: >Last-Modified: >Originator: Eric Jacobs >Release: STABLE, CURRENT >Organization: >Environment: >Description: The fields cg_rotor, cg_frotor, and cg_irotor are declared as signed integers in sys/ufs/ffs/fs.h. However, the function pass5() in src/sbin/fsck_ffs/pass5.c (or src/sbin/fsck/pass5.c) only corrects rotor values that are too high, not too low. >How-To-Repeat: Simulate a crash on a filesystem that corrupts the cg_rotor field of a cylinder group to a negative number. When fsck repairs the file system, it leaves the negative values and marks the filesystem clean. If the filesystem is then mounted read-write and the kernel attempts to allocate from the CG, it will panic. >Fix: *** pass5.c.orig Wed Jul 17 12:48:04 2002 --- pass5.c Wed Jul 17 12:50:14 2002 *************** *** 182,196 **** newcg->cg_cs.cs_nffree = 0; newcg->cg_cs.cs_nbfree = 0; newcg->cg_cs.cs_nifree = fs->fs_ipg; ! if (cg->cg_rotor < newcg->cg_ndblk) newcg->cg_rotor = cg->cg_rotor; else newcg->cg_rotor = 0; ! if (cg->cg_frotor < newcg->cg_ndblk) newcg->cg_frotor = cg->cg_frotor; else newcg->cg_frotor = 0; ! if (cg->cg_irotor < fs->fs_ipg) newcg->cg_irotor = cg->cg_irotor; else newcg->cg_irotor = 0; --- 182,196 ---- newcg->cg_cs.cs_nffree = 0; newcg->cg_cs.cs_nbfree = 0; newcg->cg_cs.cs_nifree = fs->fs_ipg; ! if ((cg->cg_rotor >= 0) && (cg->cg_rotor < newcg->cg_ndblk)) newcg->cg_rotor = cg->cg_rotor; else newcg->cg_rotor = 0; ! if ((cg->cg_frotor >= 0) && (cg->cg_frotor < newcg->cg_ndblk)) newcg->cg_frotor = cg->cg_frotor; else newcg->cg_frotor = 0; ! if ((cg->cg_irotor >= 0) && (cg->cg_irotor < fs->fs_ipg)) newcg->cg_irotor = cg->cg_irotor; else newcg->cg_irotor = 0; >Release-Note: >Audit-Trail: >Unformatted: To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-bugs" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200207171653.g6HGrPTB050679>