From owner-svn-src-all@freebsd.org  Fri Apr 14 15:22:02 2017
Return-Path: <owner-svn-src-all@freebsd.org>
Delivered-To: svn-src-all@mailman.ysv.freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org
 [IPv6:2001:1900:2254:206a::19:1])
 by mailman.ysv.freebsd.org (Postfix) with ESMTP id 2442AD3D505;
 Fri, 14 Apr 2017 15:22:02 +0000 (UTC) (envelope-from kib@FreeBSD.org)
Received: from repo.freebsd.org (repo.freebsd.org
 [IPv6:2610:1c1:1:6068::e6a:0])
 (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
 (Client did not present a certificate)
 by mx1.freebsd.org (Postfix) with ESMTPS id E57EA784;
 Fri, 14 Apr 2017 15:22:01 +0000 (UTC) (envelope-from kib@FreeBSD.org)
Received: from repo.freebsd.org ([127.0.1.37])
 by repo.freebsd.org (8.15.2/8.15.2) with ESMTP id v3EFM0of092172;
 Fri, 14 Apr 2017 15:22:00 GMT (envelope-from kib@FreeBSD.org)
Received: (from kib@localhost)
 by repo.freebsd.org (8.15.2/8.15.2/Submit) id v3EFM09u092171;
 Fri, 14 Apr 2017 15:22:00 GMT (envelope-from kib@FreeBSD.org)
Message-Id: <201704141522.v3EFM09u092171@repo.freebsd.org>
X-Authentication-Warning: repo.freebsd.org: kib set sender to kib@FreeBSD.org
 using -f
From: Konstantin Belousov <kib@FreeBSD.org>
Date: Fri, 14 Apr 2017 15:22:00 +0000 (UTC)
To: src-committers@freebsd.org, svn-src-all@freebsd.org,
 svn-src-head@freebsd.org
Subject: svn commit: r316852 - head/sbin/fsck_ffs
X-SVN-Group: head
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
X-BeenThere: svn-src-all@freebsd.org
X-Mailman-Version: 2.1.23
Precedence: list
List-Id: "SVN commit messages for the entire src tree \(except for &quot;
 user&quot; and &quot; projects&quot; \)" <svn-src-all.freebsd.org>
List-Unsubscribe: <https://lists.freebsd.org/mailman/options/svn-src-all>,
 <mailto:svn-src-all-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/svn-src-all/>
List-Post: <mailto:svn-src-all@freebsd.org>
List-Help: <mailto:svn-src-all-request@freebsd.org?subject=help>
List-Subscribe: <https://lists.freebsd.org/mailman/listinfo/svn-src-all>,
 <mailto:svn-src-all-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Fri, 14 Apr 2017 15:22:02 -0000

Author: kib
Date: Fri Apr 14 15:22:00 2017
New Revision: 316852
URL: https://svnweb.freebsd.org/changeset/base/316852

Log:
  In fsck_ffs pass1, prevent the inosused variable from wrapping.
  
  The loop that scans the used inode map when soft updates is in use
  assumes that the inosused variable is signed.  However, ino_t is
  unsigned, so the loop invariant is incorrect and the check for
  inosused wrapping to < 0 can never be true.
  
  Instead of checking for wrap after the fact just prevent it from
  happening in the first place.
  
  PR:	218592
  Submitted by:	Todd Miller <todd.miller@courtesan.com>
  Reviewed by:	mckusick
  MFC after:	1 week

Modified:
  head/sbin/fsck_ffs/pass1.c

Modified: head/sbin/fsck_ffs/pass1.c
==============================================================================
--- head/sbin/fsck_ffs/pass1.c	Fri Apr 14 15:16:41 2017	(r316851)
+++ head/sbin/fsck_ffs/pass1.c	Fri Apr 14 15:22:00 2017	(r316852)
@@ -133,9 +133,14 @@ pass1(void)
 		 */
 		if ((preen || inoopt) && usedsoftdep && !rebuildcg) {
 			cp = &cg_inosused(cgp)[(inosused - 1) / CHAR_BIT];
-			for ( ; inosused > 0; inosused -= CHAR_BIT, cp--) {
-				if (*cp == 0)
+			for ( ; inosused != 0; cp--) {
+				if (*cp == 0) {
+					if (inosused > CHAR_BIT)
+						inosused -= CHAR_BIT;
+					else
+						inosused = 0;
 					continue;
+				}
 				for (i = 1 << (CHAR_BIT - 1); i > 0; i >>= 1) {
 					if (*cp & i)
 						break;
@@ -143,8 +148,6 @@ pass1(void)
 				}
 				break;
 			}
-			if (inosused < 0)
-				inosused = 0;
 		}
 		/*
 		 * Allocate inoinfo structures for the allocated inodes.