i386/28536: writing to corrupted msdosfs causes kernel panic

[Jiangyi Liu]

>Number: 28536
>Category: i386
>Synopsis: writing to corrupted msdosfs causes kernel panic
>Confidential: no
>Severity: serious
>Priority: medium
>Responsible: freebsd-bugs
>State: open
>Quarter:
>Keywords:
>Date-Required:
>Class: sw-bug
>Submitter-Id: current-users
>Arrival-Date: Sat Jun 30 05:40:01 PDT 2001
>Closed-Date:
>Last-Modified:
>Originator: Jiangyi Liu
>Release: 4.3-STABLE
>Organization:
>Environment:
FreeBSD fatcow.home 4.3-STABLE FreeBSD 4.3-STABLE #0: Sat Jun 30 14:52:22 CST 2001 jy...@fatcow.home:/usr/src/sys/compile/FATCOW i386

>Description:
In -current and -stable, mountmsdosfs()@ msdosfs_vfsops.c doesn't not check if pm_nxtfree exceeds the max cluster in the file system. So if a corrupted msdos filesystem(which is not uncommon) is written, the following code in updatefats()@msdosfs_fat.c will generate a panic.

u_long cn = pmp->pm_nxtfree;

if (pmp->pm_freeclustercount
&& (pmp->pm_inusemap[cn / N_INUSEBITS]
& (1 << (cn % N_INUSEBITS)))) { .... }

>How-To-Repeat:
Mount a corrupted msdos filesystem(e.g. not probably shutdown) and write to it.
>Fix:
Apply the following patch to test if next free cluster exceeds the max cluster in mountmsdosfs().

*** msdosfs_vfsops.c.orig Sat Jun 30 14:21:15 2001
--- msdosfs_vfsops.c Sat Jun 30 14:30:25 2001
***************
*** 681,686 ****
--- 681,692 ----
/*
* Check and validate (or perhaps invalidate?) the fsinfo structure? XXX
*/
+ if (pmp->pm_fsinfo && pmp->pm_nxtfree > pmp->pm_maxcluster) {
+ printf ("Next free cluster in FSInfo (%u) exceeds maxcluster (%u)\n",
+ pmp->pm_nxtfree, pmp->pm_maxcluster);
+ error = EINVAL;
+ goto error_exit;
+ }

/*
* Allocate memory for the bitmap of allocated clusters, and then
>Release-Note:
>Audit-Trail:
>Unformatted:

To Unsubscribe: send mail to majo...@FreeBSD.org
with "unsubscribe freebsd-bugs" in the body of the message