Module Name: src Committed By: maxv Date: Tue Mar 10 12:59:32 UTC 2015
Modified Files: src/sys/ufs/ffs: ffs_vfsops.c Log Message: ffs_superblock_validate(): check the number of inodes per block. Otherwise a malformed value could panic the system. To generate a diff of this commit: cvs rdiff -u -r1.321 -r1.322 src/sys/ufs/ffs/ffs_vfsops.c Please note that diffs are not public domain; they are subject to the copyright notices on the relevant files.
Modified files: Index: src/sys/ufs/ffs/ffs_vfsops.c diff -u src/sys/ufs/ffs/ffs_vfsops.c:1.321 src/sys/ufs/ffs/ffs_vfsops.c:1.322 --- src/sys/ufs/ffs/ffs_vfsops.c:1.321 Tue Mar 3 17:56:51 2015 +++ src/sys/ufs/ffs/ffs_vfsops.c Tue Mar 10 12:59:32 2015 @@ -1,4 +1,4 @@ -/* $NetBSD: ffs_vfsops.c,v 1.321 2015/03/03 17:56:51 maxv Exp $ */ +/* $NetBSD: ffs_vfsops.c,v 1.322 2015/03/10 12:59:32 maxv Exp $ */ /*- * Copyright (c) 2008, 2009 The NetBSD Foundation, Inc. @@ -61,7 +61,7 @@ */ #include <sys/cdefs.h> -__KERNEL_RCSID(0, "$NetBSD: ffs_vfsops.c,v 1.321 2015/03/03 17:56:51 maxv Exp $"); +__KERNEL_RCSID(0, "$NetBSD: ffs_vfsops.c,v 1.322 2015/03/10 12:59:32 maxv Exp $"); #if defined(_KERNEL_OPT) #include "opt_ffs.h" @@ -919,6 +919,7 @@ static int ffs_superblock_validate(struct fs *fs) { int32_t i, fs_bshift = 0, fs_fshift = 0, fs_fragshift = 0, fs_frag; + int32_t fs_inopb; /* Check the superblock size */ if (fs->fs_sbsize > SBLOCKSIZE || fs->fs_sbsize < sizeof(struct fs)) @@ -941,6 +942,14 @@ ffs_superblock_validate(struct fs *fs) if (fs->fs_cssize == 0) return 0; + /* Check the number of inodes per block */ + if (fs->fs_magic == FS_UFS1_MAGIC) + fs_inopb = fs->fs_bsize / sizeof(struct ufs1_dinode); + else /* fs->fs_magic == FS_UFS2_MAGIC */ + fs_inopb = fs->fs_bsize / sizeof(struct ufs2_dinode); + if (fs->fs_inopb != fs_inopb) + return 0; + /* Block size cannot be smaller than fragment size */ if (fs->fs_bsize < fs->fs_fsize) return 0;