Module Name: src
Committed By: maxv
Date: Sun Feb 22 14:22:34 UTC 2015
Modified Files:
src/sys/ufs/ffs: ffs_vfsops.c
Log Message:
ffs_superblock_validate(): sanitize fs_fragshift, fs_bmask and fs_fmask.
To generate a diff of this commit:
cvs rdiff -u -r1.317 -r1.318 src/sys/ufs/ffs/ffs_vfsops.c
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
Modified files:
Index: src/sys/ufs/ffs/ffs_vfsops.c
diff -u src/sys/ufs/ffs/ffs_vfsops.c:1.317 src/sys/ufs/ffs/ffs_vfsops.c:1.318
--- src/sys/ufs/ffs/ffs_vfsops.c:1.317 Fri Feb 20 17:10:17 2015
+++ src/sys/ufs/ffs/ffs_vfsops.c Sun Feb 22 14:22:34 2015
@@ -1,4 +1,4 @@
-/* $NetBSD: ffs_vfsops.c,v 1.317 2015/02/20 17:10:17 maxv Exp $ */
+/* $NetBSD: ffs_vfsops.c,v 1.318 2015/02/22 14:22:34 maxv Exp $ */
/*-
* Copyright (c) 2008, 2009 The NetBSD Foundation, Inc.
@@ -61,7 +61,7 @@
*/
#include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: ffs_vfsops.c,v 1.317 2015/02/20 17:10:17 maxv Exp $");
+__KERNEL_RCSID(0, "$NetBSD: ffs_vfsops.c,v 1.318 2015/02/22 14:22:34 maxv Exp $");
#if defined(_KERNEL_OPT)
#include "opt_ffs.h"
@@ -922,7 +922,7 @@ static const int sblock_try[] = SBLOCKSE
static int
ffs_superblock_validate(struct fs *fs)
{
- int32_t i, fs_bshift = 0, fs_fshift = 0, fs_frag;
+ int32_t i, fs_bshift = 0, fs_fshift = 0, fs_fragshift = 0, fs_frag;
/* Check the superblock size */
if (fs->fs_sbsize > SBLOCKSIZE || fs->fs_sbsize < sizeof(struct fs))
@@ -937,6 +937,8 @@ ffs_superblock_validate(struct fs *fs)
/* Check the size of frag blocks */
if (!powerof2(fs->fs_fsize))
return 0;
+ if (fs->fs_fsize == 0)
+ return 0;
if (fs->fs_size == 0)
return 0;
@@ -959,7 +961,21 @@ ffs_superblock_validate(struct fs *fs)
if (fs->fs_fshift != fs_fshift)
return 0;
- /* Now that the shifts are sanitized, we can use the ffs_ API */
+ /* Compute fs_fragshift and ensure it is consistent */
+ for (i = fs->fs_frag; i > 1; i >>= 1)
+ fs_fragshift++;
+ if (fs->fs_fragshift != fs_fragshift)
+ return 0;
+
+ /* Check the masks */
+ if (fs->fs_bmask != ~(fs->fs_bsize - 1))
+ return 0;
+ if (fs->fs_fmask != ~(fs->fs_fsize - 1))
+ return 0;
+
+ /*
+ * Now that the shifts and masks are sanitized, we can use the ffs_ API.
+ */
/* Check the number of frag blocks */
if ((fs_frag = ffs_numfrags(fs, fs->fs_bsize)) > MAXFRAG)
@@ -1205,7 +1221,8 @@ ffs_mountfs(struct vnode *devvp, struct
brelse(bp, 0);
bp = NULL;
- /* First check to see if this is tagged as an Apple UFS filesystem
+ /*
+ * First check to see if this is tagged as an Apple UFS filesystem
* in the disklabel
*/
if (getdiskinfo(devvp, &dkw) == 0 &&
@@ -1213,7 +1230,8 @@ ffs_mountfs(struct vnode *devvp, struct
ump->um_flags |= UFS_ISAPPLEUFS;
#ifdef APPLE_UFS
else {
- /* Manually look for an apple ufs label, and if a valid one
+ /*
+ * Manually look for an apple ufs label, and if a valid one
* is found, then treat it like an Apple UFS filesystem anyway
*/
error = bread(devvp,
@@ -1346,12 +1364,14 @@ ffs_mountfs(struct vnode *devvp, struct
fs->fs_contigdirs = space;
space = (char *)space + bsize;
memset(fs->fs_contigdirs, 0, bsize);
- /* Compatibility for old filesystems - XXX */
+
+ /* Compatibility for old filesystems - XXX */
if (fs->fs_avgfilesize <= 0)
fs->fs_avgfilesize = AVFILESIZ;
if (fs->fs_avgfpdir <= 0)
fs->fs_avgfpdir = AFPDIR;
fs->fs_active = NULL;
+
mp->mnt_data = ump;
mp->mnt_stat.f_fsidx.__fsid_val[0] = (long)dev;
mp->mnt_stat.f_fsidx.__fsid_val[1] = makefstype(MOUNT_FFS);
