From nobody@FreeBSD.org  Wed Jul 17 09:53:26 2002
Return-Path: <nobody@FreeBSD.org>
Received: from mx1.FreeBSD.org (mx1.FreeBSD.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id 29D9337B400
	for <freebsd-gnats-submit@FreeBSD.org>; Wed, 17 Jul 2002 09:53:26 -0700 (PDT)
Received: from www.freebsd.org (www.FreeBSD.org [216.136.204.117])
	by mx1.FreeBSD.org (Postfix) with ESMTP id BD46843E5E
	for <freebsd-gnats-submit@FreeBSD.org>; Wed, 17 Jul 2002 09:53:25 -0700 (PDT)
	(envelope-from nobody@FreeBSD.org)
Received: from www.freebsd.org (localhost [127.0.0.1])
	by www.freebsd.org (8.12.4/8.12.4) with ESMTP id g6HGrPOT050680
	for <freebsd-gnats-submit@FreeBSD.org>; Wed, 17 Jul 2002 09:53:25 -0700 (PDT)
	(envelope-from nobody@www.freebsd.org)
Received: (from nobody@localhost)
	by www.freebsd.org (8.12.4/8.12.4/Submit) id g6HGrPTB050679;
	Wed, 17 Jul 2002 09:53:25 -0700 (PDT)
Message-Id: <200207171653.g6HGrPTB050679@www.freebsd.org>
Date: Wed, 17 Jul 2002 09:53:25 -0700 (PDT)
From: Eric Jacobs <eaja@erols.com>
To: freebsd-gnats-submit@FreeBSD.org
Subject: fsck[_ffs](8) doesn't ensure that (signed) cylinder group rotor values are non-negative
X-Send-Pr-Version: www-1.0

>Number:         40697
>Category:       bin
>Synopsis:       fsck[_ffs](8) doesn't ensure that (signed) cylinder group rotor values are non-negative
>Confidential:   no
>Severity:       serious
>Priority:       low
>Responsible:    freebsd-bugs
>State:          closed
>Quarter:        
>Keywords:       
>Date-Required:  
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Wed Jul 17 10:00:05 PDT 2002
>Closed-Date:    Sun Nov 24 13:48:04 PST 2002
>Last-Modified:  Sun Nov 24 13:48:04 PST 2002
>Originator:     Eric Jacobs
>Release:        STABLE, CURRENT
>Organization:
>Environment:
>Description:
The fields cg_rotor, cg_frotor, and cg_irotor are declared as signed
integers in sys/ufs/ffs/fs.h. However, the function pass5() in
src/sbin/fsck_ffs/pass5.c (or src/sbin/fsck/pass5.c) only corrects
rotor values that are too high, not too low.
>How-To-Repeat:
Simulate a crash on a filesystem that corrupts the cg_rotor field
of a cylinder group to a negative number. When fsck repairs the file
system, it leaves the negative values and marks the filesystem
clean. If the filesystem is then mounted read-write and the kernel
attempts to allocate from the CG, it will panic.

>Fix:
*** pass5.c.orig	Wed Jul 17 12:48:04 2002
--- pass5.c	Wed Jul 17 12:50:14 2002
***************
*** 182,196 ****
  		newcg->cg_cs.cs_nffree = 0;
  		newcg->cg_cs.cs_nbfree = 0;
  		newcg->cg_cs.cs_nifree = fs->fs_ipg;
! 		if (cg->cg_rotor < newcg->cg_ndblk)
  			newcg->cg_rotor = cg->cg_rotor;
  		else
  			newcg->cg_rotor = 0;
! 		if (cg->cg_frotor < newcg->cg_ndblk)
  			newcg->cg_frotor = cg->cg_frotor;
  		else
  			newcg->cg_frotor = 0;
! 		if (cg->cg_irotor < fs->fs_ipg)
  			newcg->cg_irotor = cg->cg_irotor;
  		else
  			newcg->cg_irotor = 0;
--- 182,196 ----
  		newcg->cg_cs.cs_nffree = 0;
  		newcg->cg_cs.cs_nbfree = 0;
  		newcg->cg_cs.cs_nifree = fs->fs_ipg;
!                 if ((cg->cg_rotor >= 0) && (cg->cg_rotor < newcg->cg_ndblk))
  			newcg->cg_rotor = cg->cg_rotor;
  		else
  			newcg->cg_rotor = 0;
!                 if ((cg->cg_frotor >= 0) && (cg->cg_frotor < newcg->cg_ndblk))
  			newcg->cg_frotor = cg->cg_frotor;
  		else
  			newcg->cg_frotor = 0;
!                 if ((cg->cg_irotor >= 0) && (cg->cg_irotor < fs->fs_ipg))
  			newcg->cg_irotor = cg->cg_irotor;
  		else
  			newcg->cg_irotor = 0;

>Release-Note:
>Audit-Trail:
State-Changed-From-To: open->closed 
State-Changed-By: julian 
State-Changed-When: Sun Nov 24 13:47:22 PST 2002 
State-Changed-Why:  
Patch applied to -current 


http://www.freebsd.org/cgi/query-pr.cgi?pr=40697 
>Unformatted:
