Date: Wed, 6 Jul 2022 21:45:56 GMT From: Kirk McKusick <mckusick@FreeBSD.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org Subject: git: f3f5368dfbef - main - Bug fix to UFS/FFS superblock integrity checks when reading a superblock. Message-ID: <202207062145.266Lju3w064261@gitrepo.freebsd.org>
next in thread | raw e-mail | index | archive | help
The branch main has been updated by mckusick: URL: https://cgit.FreeBSD.org/src/commit/?id=f3f5368dfbef4514686ba2d67f01f314b275227e commit f3f5368dfbef4514686ba2d67f01f314b275227e Author: Kirk McKusick <mckusick@FreeBSD.org> AuthorDate: 2022-07-06 20:28:07 +0000 Commit: Kirk McKusick <mckusick@FreeBSD.org> CommitDate: 2022-07-06 21:45:29 +0000 Bug fix to UFS/FFS superblock integrity checks when reading a superblock. The tests for number of cylinder groups (fs_ncg), inodes per cylinder group (fs_ipg), and the size and layout of the cylinder group summary information (fs_csaddr and fs_cssize) were overly restrictive and would exclude some valid filesystems. These updates avoid precluding valid fiesystems while still detecting rogue values that can crash or hang the kernel. Reported by: Chuck Silvers Tested by: Peter Holm MFC after: 1 month (with 076002f24d35) Differential Revision: https://reviews.freebsd.org/D35219 --- sys/ufs/ffs/ffs_subr.c | 34 ++++++++++++++++------------------ 1 file changed, 16 insertions(+), 18 deletions(-) diff --git a/sys/ufs/ffs/ffs_subr.c b/sys/ufs/ffs/ffs_subr.c index f4c854172fb3..438745f8eb49 100644 --- a/sys/ufs/ffs/ffs_subr.c +++ b/sys/ufs/ffs/ffs_subr.c @@ -330,8 +330,8 @@ readsuper(void *devfd, struct fs **fsp, off_t sblockloc, int isaltsblk, static int validate_sblock(struct fs *fs, int isaltsblk) { - int i, sectorsize; - u_int64_t maxfilesize, minfpg, sizepb; + u_long i, sectorsize, cgnum; + u_int64_t maxfilesize, sizepb; sectorsize = dbtob(1); if (fs->fs_magic == FS_UFS2_MAGIC) { @@ -409,7 +409,6 @@ validate_sblock(struct fs *fs, int isaltsblk) CHK(fs->fs_iblkno, !=, fs->fs_cblkno + fs->fs_frag, %jd); CHK(fs->fs_dblkno, !=, fs->fs_iblkno + fs->fs_ipg / INOPF(fs), %jd); CHK(fs->fs_cgsize, >, fs->fs_bsize, %jd); - CHK(fs->fs_csaddr, !=, cgdmin(fs, 0), %jd); CHK(fs->fs_cssize, !=, fragroundup(fs, fs->fs_ncg * sizeof(struct csum)), %jd); CHK(fs->fs_dsize, !=, fs->fs_size - fs->fs_sblkno - @@ -429,24 +428,24 @@ validate_sblock(struct fs *fs, int isaltsblk) * makes it hard to tightly bound them. So we can only check * that they are within a broader possible range. * - * Calculate minfpg, the minimum number of fragments that can be - * in a cylinder group. The value 12289 is calculated in newfs(8) - * when creating the smallest block size UFS version 1 filesystem - * (4096 block size) with no fragments (4096 fragment size). That - * number may be depressed even further for very small filesystems - * since newfs(8) strives to have at least four cylinder groups. + * The size cannot always be accurately determined, but ensure + * that it is consistent with the number of cylinder groups (fs_ncg) + * and the number of fragments per cylinder group (fs_fpg). Ensure + * that the summary information size is correct and that it starts + * and ends in the data area of the same cylinder group. */ - minfpg = MIN(12289, fs->fs_size / 4); CHK(fs->fs_ncg, <, 1, %jd); - CHK(fs->fs_ncg, >, (fs->fs_size / minfpg) + 1, %jd); - CHK(fs->fs_fpg, <, minfpg, %jd); - CHK(fs->fs_fpg, >, fs->fs_size, %jd); - CHK(fs->fs_ipg * fs->fs_ncg, >, (((int64_t)(1)) << 32) - INOPB(fs), - %jd); - CHK(fs->fs_ipg, >, fs->fs_fpg, %jd); CHK(fs->fs_size, <, 8 * fs->fs_frag, %jd); CHK(fs->fs_size, <=, (fs->fs_ncg - 1) * fs->fs_fpg, %jd); CHK(fs->fs_size, >, fs->fs_ncg * fs->fs_fpg, %jd); + CHK(fs->fs_cssize, !=, + fragroundup(fs, fs->fs_ncg * sizeof(struct csum)), %jd); + cgnum = dtog(fs, fs->fs_csaddr); + CHK(fs->fs_csaddr, <, cgdmin(fs, cgnum), %jd); + CHK(dtog(fs, fs->fs_csaddr + howmany(fs->fs_cssize, fs->fs_fsize)), >, + cgnum, %jd); + CHK(fs->fs_ipg * fs->fs_ncg, >, (((int64_t)(1)) << 32) - INOPB(fs), + %jd); /* * With file system clustering it is possible to allocate * many contiguous blocks. The kernel variable maxphys defines @@ -466,9 +465,8 @@ validate_sblock(struct fs *fs, int isaltsblk) * those (mostly 32-bit machines) can (very slowly) handle I/O * requests that exceed maxphys. */ - CHK(fs->fs_maxcontig, <, 1, %jd); - CHK(fs->fs_maxcontig, >, MAX(256, maxphys / fs->fs_bsize), %jd); CHK(fs->fs_maxcontig, <, 0, %jd); + CHK(fs->fs_maxcontig, >, MAX(256, maxphys / fs->fs_bsize), %jd); CHK2(fs->fs_maxcontig, ==, 0, fs->fs_contigsumsize, !=, 0, %jd); CHK2(fs->fs_maxcontig, >, 1, fs->fs_contigsumsize, !=, MIN(fs->fs_maxcontig, FS_MAXCONTIG), %jd);
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?202207062145.266Lju3w064261>