Date: Sat, 30 Jun 2001 05:30:20 -0700 (PDT) From: Jiangyi Liu <jyliu@163.net> To: freebsd-gnats-submit@FreeBSD.org Subject: i386/28536: writing to corrupted msdosfs causes kernel panic Message-ID: <200106301230.f5UCUKS04942@freefall.freebsd.org>
next in thread | raw e-mail | index | archive | help
>Number: 28536
>Category: i386
>Synopsis: writing to corrupted msdosfs causes kernel panic
>Confidential: no
>Severity: serious
>Priority: medium
>Responsible: freebsd-bugs
>State: open
>Quarter:
>Keywords:
>Date-Required:
>Class: sw-bug
>Submitter-Id: current-users
>Arrival-Date: Sat Jun 30 05:40:01 PDT 2001
>Closed-Date:
>Last-Modified:
>Originator: Jiangyi Liu
>Release: 4.3-STABLE
>Organization:
>Environment:
FreeBSD fatcow.home 4.3-STABLE FreeBSD 4.3-STABLE #0: Sat Jun 30 14:52:22 CST 2001 jyliu@fatcow.home:/usr/src/sys/compile/FATCOW i386
>Description:
In -current and -stable, mountmsdosfs()@ msdosfs_vfsops.c doesn't not check if pm_nxtfree exceeds the max cluster in the file system. So if a corrupted msdos filesystem(which is not uncommon) is written, the following code in updatefats()@msdosfs_fat.c will generate a panic.
u_long cn = pmp->pm_nxtfree;
if (pmp->pm_freeclustercount
&& (pmp->pm_inusemap[cn / N_INUSEBITS]
& (1 << (cn % N_INUSEBITS)))) { .... }
>How-To-Repeat:
Mount a corrupted msdos filesystem(e.g. not probably shutdown) and write to it.
>Fix:
Apply the following patch to test if next free cluster exceeds the max cluster in mountmsdosfs().
*** msdosfs_vfsops.c.orig Sat Jun 30 14:21:15 2001
--- msdosfs_vfsops.c Sat Jun 30 14:30:25 2001
***************
*** 681,686 ****
--- 681,692 ----
/*
* Check and validate (or perhaps invalidate?) the fsinfo structure? XXX
*/
+ if (pmp->pm_fsinfo && pmp->pm_nxtfree > pmp->pm_maxcluster) {
+ printf ("Next free cluster in FSInfo (%u) exceeds maxcluster (%u)\n",
+ pmp->pm_nxtfree, pmp->pm_maxcluster);
+ error = EINVAL;
+ goto error_exit;
+ }
/*
* Allocate memory for the bitmap of allocated clusters, and then
>Release-Note:
>Audit-Trail:
>Unformatted:
To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-bugs" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200106301230.f5UCUKS04942>