From nobody Tue Mar 7 23:02:40 2023 X-Original-To: dev-commits-src-main@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4PWWDw5bY4z3wmB3; Tue, 7 Mar 2023 23:02:40 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4PWWDw4tmPz46Rn; Tue, 7 Mar 2023 23:02:40 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1678230160; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=cymPBLCbUkMXXpYp8YYTkXl2RvyPVgpqeeil4KpmpgI=; b=Ykr6ByzjcoemyjQi9wczBSA8B9fqPvF4jcAAGFD3VGTJTwXdrpInJ1H+AKy2lqFPWKsJ/4 lpJoC6ez/qgI3DExRVJW/N0Rk6UlkEC16Z/lgX4/aalKWVSV96L3PJ2HYvejzJQ923Q6+V LshX56l3zHyRdnANiQKs+TWoi8AxgHuXmwsa4t9WxvDgMNnJQ/6qXeI+RCkN/7SPhZc8TV 9uuxnv2sNIjY1Lk8t5jffG9zk61wAXV0UDd7LgnRkoHbiJVEb1Av3LH1/Qr3gc12SYqO6h DE4qjwv4Ln+kTrXb/dZz8SlA3NrFfKLFk0/NfZ/kVRuPN2ytNLkWdXEKPqtHvA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1678230160; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=cymPBLCbUkMXXpYp8YYTkXl2RvyPVgpqeeil4KpmpgI=; b=v+cTqfPOo9GDj/fYGlme+3fwRljEkgrQmfMY26052yioHNMVJ+Nq8Yp7TIsQgP6ZZAowsZ pAkgTutFIG+Y7Rsmt+yyUO11oygoWL5XwTl5YB413IBK+JHBCEFMGH6IMoTsRMNMebc7Fs UpPcTDmGBl9wDt0UBR4RR+iuGfEYS3hrp9+uCBWjC1gXMWySj79dsws1D8lBDNM+4EeSWV uTG+tVvdQq8ky8b3/Wisk1dePxrMi+7nfYgk7yw1Fsyw8dVkSFLaLYk8TWKC1GOwCj3Yud iSsGiBaMHcVMxX/rLcOykVwo+398WutAtWEHbsxtOhXoCOqF3VHkaZEfwvfR2g== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1678230160; a=rsa-sha256; cv=none; b=rK6kYYd/zlYDvhXMrUlRwyQTRnBZXOx4a+1gtme7q5e+sdhTxtnq6RiFmOOxPX4IzXp2Ef b37o7ar+XRYULGYqPsU5j9ZJRm1EoUa6U0A9YZ/LsA2W1cFZG5xPvkLgyloK94JpjuRaOy Ui1H1md48VwVMWSYVqxLXBpDGU2ewDWSyXVqfJR+wfJ2hoEd+P1iYfvkJUd/eng0wM+bna maWPJMBVErOI8S4UYAVJ89bt1/hujRSsO+XUT0G4azT/Z0N2fhRjalQBkpv9v0iOY4xp4s ZmLgiwPpEsUAzfN37VCs68dd+D1+TTrpZW/KiQvaO35yMxojw6B51D4wKH2LiA== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 4PWWDw3ykFz129X; Tue, 7 Mar 2023 23:02:40 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.16.1/8.16.1) with ESMTP id 327N2e6v031271; Tue, 7 Mar 2023 23:02:40 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.16.1/8.16.1/Submit) id 327N2eBN031270; Tue, 7 Mar 2023 23:02:40 GMT (envelope-from git) Date: Tue, 7 Mar 2023 23:02:40 GMT Message-Id: <202303072302.327N2eBN031270@gitrepo.freebsd.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org From: Kirk McKusick Subject: git: 0eabe33087d8 - main - Updates to UFS/FFS superblock integrity checks when reading a superblock. List-Id: Commit messages for the main branch of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-main List-Help: List-Post: List-Subscribe: List-Unsubscribe: Sender: owner-dev-commits-src-main@freebsd.org X-BeenThere: dev-commits-src-main@freebsd.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: mckusick X-Git-Repository: src X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: 0eabe33087d8cb69ae800daae322f12a8f16bd10 Auto-Submitted: auto-generated X-ThisMailContainsUnwantedMimeParts: N The branch main has been updated by mckusick: URL: https://cgit.FreeBSD.org/src/commit/?id=0eabe33087d8cb69ae800daae322f12a8f16bd10 commit 0eabe33087d8cb69ae800daae322f12a8f16bd10 Author: Kirk McKusick AuthorDate: 2023-03-07 22:59:56 +0000 Commit: Kirk McKusick CommitDate: 2023-03-07 23:02:19 +0000 Updates to UFS/FFS superblock integrity checks when reading a superblock. Have to add a check that the computed cylinder group size does not exceed the block size of the filesystem. It is also necessary to validate additional parameters when a superblock is going to be used in read-only mode if its supplementary information is going to be read in to ensure that the size and location of the supplementary information is valid. Also when a warning is raised let it be accepted, but bound the flagged field to the value checked by the warning. No legitimate superblocks should fail as a result of these changes. Reported by: Bob Prohaska, John-Mark Gurney, and Mark Millard Tested by: Peter Holm Reviewed by: Peter Holm MFC after: 2 weeks Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D38668 --- sys/ufs/ffs/ffs_subr.c | 38 ++++++++++++++++++++++++++++---------- 1 file changed, 28 insertions(+), 10 deletions(-) diff --git a/sys/ufs/ffs/ffs_subr.c b/sys/ufs/ffs/ffs_subr.c index 0b462add0d05..1d4d98fcb67d 100644 --- a/sys/ufs/ffs/ffs_subr.c +++ b/sys/ufs/ffs/ffs_subr.c @@ -347,6 +347,8 @@ readsuper(void *devfd, struct fs **fsp, off_t sblockloc, int flags, #lhs, (intmax_t)lhs, #op, #rhs, (intmax_t)rhs, wmsg);\ if (error == 0) \ error = warnerr; \ + if (warnerr == 0) \ + lhs = rhs; \ } #define FCHK2(lhs1, op1, rhs1, lhs2, op2, rhs2, fmt) \ if (lhs1 op1 rhs1 && lhs2 op2 rhs2) { \ @@ -360,16 +362,6 @@ readsuper(void *devfd, struct fs **fsp, off_t sblockloc, int flags, if (error == 0) \ error = ENOENT; \ } -#define WCHK2(lhs1, op1, rhs1, lhs2, op2, rhs2, fmt) \ - if (lhs1 op1 rhs1 && lhs2 op2 rhs2) { \ - MPRINT("UFS%d superblock failed: %s (" #fmt ") %s %s (" \ - #fmt ") && %s (" #fmt ") %s %s (" #fmt ")%s\n", \ - fs->fs_magic == FS_UFS1_MAGIC ? 1 : 2, #lhs1, \ - (intmax_t)lhs1, #op1, #rhs1, (intmax_t)rhs1, #lhs2, \ - (intmax_t)lhs2, #op2, #rhs2, (intmax_t)rhs2, wmsg); \ - if (error == 0) \ - error = warnerr; \ - } static int validate_sblock(struct fs *fs, int flags) @@ -408,6 +400,7 @@ validate_sblock(struct fs *fs, int flags) } else if (fs->fs_magic == FS_UFS1_MAGIC) { FCHK(fs->fs_sblockloc, <, 0, %jd); FCHK(fs->fs_sblockloc, >, SBLOCK_UFS1, %jd); + FCHK(fs->fs_old_ncyl, !=, fs->fs_ncg, %jd); } FCHK(fs->fs_frag, <, 1, %jd); FCHK(fs->fs_frag, >, MAXFRAG, %jd); @@ -431,6 +424,30 @@ validate_sblock(struct fs *fs, int flags) FCHK(fs->fs_sblkno, !=, roundup( howmany(fs->fs_sblockloc + SBLOCKSIZE, fs->fs_fsize), fs->fs_frag), %jd); + FCHK(CGSIZE(fs), >, fs->fs_bsize, %jd); + /* Only need to validate these if reading in csum data */ + if ((flags & UFS_NOCSUM) != 0) + return (error); + FCHK((u_int64_t)fs->fs_ipg * fs->fs_ncg, >, + (((int64_t)(1)) << 32) - INOPB(fs), %jd); + FCHK(fs->fs_cstotal.cs_nifree, <, 0, %jd); + FCHK(fs->fs_cstotal.cs_nifree, >, + (u_int64_t)fs->fs_ipg * fs->fs_ncg, %jd); + FCHK(fs->fs_cstotal.cs_ndir, >, + ((u_int64_t)fs->fs_ipg * fs->fs_ncg) - + fs->fs_cstotal.cs_nifree, %jd); + FCHK(fs->fs_size, <, 8 * fs->fs_frag, %jd); + FCHK(fs->fs_size, <=, ((int64_t)fs->fs_ncg - 1) * fs->fs_fpg, + %jd); + FCHK(fs->fs_size, >, (int64_t)fs->fs_ncg * fs->fs_fpg, %jd); + FCHK(fs->fs_csaddr, <, 0, %jd); + FCHK(fs->fs_cssize, !=, + fragroundup(fs, fs->fs_ncg * sizeof(struct csum)), %jd); + FCHK(dtog(fs, fs->fs_csaddr), >, fs->fs_ncg, %jd); + FCHK(fs->fs_csaddr, <, cgdmin(fs, dtog(fs, fs->fs_csaddr)), + %jd); + FCHK(dtog(fs, fs->fs_csaddr + howmany(fs->fs_cssize, + fs->fs_fsize)), >, dtog(fs, fs->fs_csaddr), %jd); return (error); } if (fs->fs_magic == FS_UFS2_MAGIC) { @@ -511,6 +528,7 @@ validate_sblock(struct fs *fs, int flags) FCHK(fs->fs_old_cgoffset, <, 0, %jd); FCHK2(fs->fs_old_cgoffset, >, 0, ~fs->fs_old_cgmask, <, 0, %jd); FCHK(fs->fs_old_cgoffset * (~fs->fs_old_cgmask), >, fs->fs_fpg, %jd); + FCHK(CGSIZE(fs), >, fs->fs_bsize, %jd); /* * If anything has failed up to this point, it is usafe to proceed * as checks below may divide by zero or make other fatal calculations.