From nobody@FreeBSD.org Wed Jul 17 09:53:26 2002 Return-Path: Received: from mx1.FreeBSD.org (mx1.FreeBSD.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 29D9337B400 for ; Wed, 17 Jul 2002 09:53:26 -0700 (PDT) Received: from www.freebsd.org (www.FreeBSD.org [216.136.204.117]) by mx1.FreeBSD.org (Postfix) with ESMTP id BD46843E5E for ; Wed, 17 Jul 2002 09:53:25 -0700 (PDT) (envelope-from nobody@FreeBSD.org) Received: from www.freebsd.org (localhost [127.0.0.1]) by www.freebsd.org (8.12.4/8.12.4) with ESMTP id g6HGrPOT050680 for ; Wed, 17 Jul 2002 09:53:25 -0700 (PDT) (envelope-from nobody@www.freebsd.org) Received: (from nobody@localhost) by www.freebsd.org (8.12.4/8.12.4/Submit) id g6HGrPTB050679; Wed, 17 Jul 2002 09:53:25 -0700 (PDT) Message-Id: <200207171653.g6HGrPTB050679@www.freebsd.org> Date: Wed, 17 Jul 2002 09:53:25 -0700 (PDT) From: Eric Jacobs To: freebsd-gnats-submit@FreeBSD.org Subject: fsck[_ffs](8) doesn't ensure that (signed) cylinder group rotor values are non-negative X-Send-Pr-Version: www-1.0 >Number: 40697 >Category: bin >Synopsis: fsck[_ffs](8) doesn't ensure that (signed) cylinder group rotor values are non-negative >Confidential: no >Severity: serious >Priority: low >Responsible: freebsd-bugs >State: closed >Quarter: >Keywords: >Date-Required: >Class: sw-bug >Submitter-Id: current-users >Arrival-Date: Wed Jul 17 10:00:05 PDT 2002 >Closed-Date: Sun Nov 24 13:48:04 PST 2002 >Last-Modified: Sun Nov 24 13:48:04 PST 2002 >Originator: Eric Jacobs >Release: STABLE, CURRENT >Organization: >Environment: >Description: The fields cg_rotor, cg_frotor, and cg_irotor are declared as signed integers in sys/ufs/ffs/fs.h. However, the function pass5() in src/sbin/fsck_ffs/pass5.c (or src/sbin/fsck/pass5.c) only corrects rotor values that are too high, not too low. >How-To-Repeat: Simulate a crash on a filesystem that corrupts the cg_rotor field of a cylinder group to a negative number. When fsck repairs the file system, it leaves the negative values and marks the filesystem clean. If the filesystem is then mounted read-write and the kernel attempts to allocate from the CG, it will panic. >Fix: *** pass5.c.orig Wed Jul 17 12:48:04 2002 --- pass5.c Wed Jul 17 12:50:14 2002 *************** *** 182,196 **** newcg->cg_cs.cs_nffree = 0; newcg->cg_cs.cs_nbfree = 0; newcg->cg_cs.cs_nifree = fs->fs_ipg; ! if (cg->cg_rotor < newcg->cg_ndblk) newcg->cg_rotor = cg->cg_rotor; else newcg->cg_rotor = 0; ! if (cg->cg_frotor < newcg->cg_ndblk) newcg->cg_frotor = cg->cg_frotor; else newcg->cg_frotor = 0; ! if (cg->cg_irotor < fs->fs_ipg) newcg->cg_irotor = cg->cg_irotor; else newcg->cg_irotor = 0; --- 182,196 ---- newcg->cg_cs.cs_nffree = 0; newcg->cg_cs.cs_nbfree = 0; newcg->cg_cs.cs_nifree = fs->fs_ipg; ! if ((cg->cg_rotor >= 0) && (cg->cg_rotor < newcg->cg_ndblk)) newcg->cg_rotor = cg->cg_rotor; else newcg->cg_rotor = 0; ! if ((cg->cg_frotor >= 0) && (cg->cg_frotor < newcg->cg_ndblk)) newcg->cg_frotor = cg->cg_frotor; else newcg->cg_frotor = 0; ! if ((cg->cg_irotor >= 0) && (cg->cg_irotor < fs->fs_ipg)) newcg->cg_irotor = cg->cg_irotor; else newcg->cg_irotor = 0; >Release-Note: >Audit-Trail: State-Changed-From-To: open->closed State-Changed-By: julian State-Changed-When: Sun Nov 24 13:47:22 PST 2002 State-Changed-Why: Patch applied to -current http://www.freebsd.org/cgi/query-pr.cgi?pr=40697 >Unformatted: