Resending this old diff. Adjusted to apply with -current source: Illegal fragmentation block sizes can trigger division by zero in the disklabel and fsck_ffs tools.
See this sequence of commands to reproduce: # dd if=/dev/zero of=nofrag.iso bs=1M count=1 # vnconfig vnd0 nofrag.iso # disklabel -e vnd0 Create 'a' and set fsize = bsize = 1. A line like this one will do a: 2048 0 4.2BSD 1 1 1 # fsck_ffs vnd0a ** /dev/vnd0a (vnd0a) BAD SUPER BLOCK: MAGIC NUMBER WRONG Floating point exception (core dumped) # disklabel -E vnd0 Label editor (enter '?' for help at any prompt) > m a offset: [0] size: [2048] FS type: [4.2BSD] Floating point exception (core dumped) # vnconfig -u vnd0 A fragmentation (block) size smaller than a sector size is not valid while using "disklabel -E", and really doesn't make sense. While using "disklabel -e", not all validation checks are performed, which makes it possible to enter invalid values. If "disklabel -E" is used without the expert mode, fragmentation sizes cannot be changed and will be just accepted from the parsed disklabel, resulting in a division by zero if they are too small. And the same happens in fsck_ffs. Instead of coming up with a guessed value in fsck_ffs, I think it's better to simply fail and let the user fix the disklabel. After all, it shouldn't be fsck_ffs's duty to fix faulty values outside the filesystem. Index: sbin/disklabel/disklabel.c =================================================================== RCS file: /cvs/src/sbin/disklabel/disklabel.c,v retrieving revision 1.227 diff -u -p -u -p -r1.227 disklabel.c --- sbin/disklabel/disklabel.c 25 Feb 2018 17:24:44 -0000 1.227 +++ sbin/disklabel/disklabel.c 27 Mar 2018 10:42:59 -0000 @@ -1100,9 +1100,24 @@ gottype: case FS_BSDFFS: NXTNUM(fsize, fsize, &errstr); - if (fsize == 0) + if (fsize < lp->d_secsize || + (fsize % lp->d_secsize) != 0) { + warnx("line %d: " + "bad fragmentation size: %s", + lineno, cp); + errors++; break; + } NXTNUM(v, v, &errstr); + if (v < fsize || (fsize != v && + fsize * 2 != v && fsize * 4 != v && + fsize * 8 != v)) { + warnx("line %d: " + "bad block size: %s", + lineno, cp); + errors++; + break; + } pp->p_fragblock = DISKLABELV1_FFS_FRAGBLOCK(fsize, v / fsize); NXTNUM(pp->p_cpg, pp->p_cpg, &errstr); Index: sbin/disklabel/editor.c =================================================================== RCS file: /cvs/src/sbin/disklabel/editor.c,v retrieving revision 1.327 diff -u -p -u -p -r1.327 editor.c --- sbin/disklabel/editor.c 8 Mar 2018 22:05:17 -0000 1.327 +++ sbin/disklabel/editor.c 27 Mar 2018 10:42:59 -0000 @@ -2069,16 +2069,16 @@ get_bsize(struct disklabel *lp, int part if (pp->p_fstype != FS_BSDFFS) return (0); + frag = DISKLABELV1_FFS_FRAG(pp->p_fragblock); + fsize = DISKLABELV1_FFS_FSIZE(pp->p_fragblock); + /* Avoid dividing by zero... */ - if (pp->p_fragblock == 0) - return(1); + if (frag * fsize < lp->d_secsize) + return (1); if (!expert) goto align; - fsize = DISKLABELV1_FFS_FSIZE(pp->p_fragblock); - frag = DISKLABELV1_FFS_FRAG(pp->p_fragblock); - for (;;) { ui = getuint64(lp, "block size", "Size of ffs blocks. 1, 2, 4 or 8 times ffs fragment size.", @@ -2119,8 +2119,7 @@ align: orig_size = DL_GETPSIZE(pp); orig_offset = DL_GETPOFFSET(pp); - bsize = (DISKLABELV1_FFS_FRAG(pp->p_fragblock) * - DISKLABELV1_FFS_FSIZE(pp->p_fragblock)) / lp->d_secsize; + bsize = (frag * fsize) / lp->d_secsize; if (DL_GETPOFFSET(pp) != starting_sector) { /* Can't change offset of first partition. */ adj = bsize - (DL_GETPOFFSET(pp) % bsize); Index: sbin/fsck_ffs/setup.c =================================================================== RCS file: /cvs/src/sbin/fsck_ffs/setup.c,v retrieving revision 1.64 diff -u -p -u -p -r1.64 setup.c --- sbin/fsck_ffs/setup.c 5 Jan 2018 09:33:47 -0000 1.64 +++ sbin/fsck_ffs/setup.c 27 Mar 2018 10:42:59 -0000 @@ -636,6 +636,10 @@ calcsb(char *dev, int devfd, struct fs * fs->fs_frag = DISKLABELV1_FFS_FRAG(pp->p_fragblock); fs->fs_fpg = pp->p_cpg * fs->fs_frag; fs->fs_bsize = fs->fs_fsize * fs->fs_frag; + if (fs->fs_bsize < lp->d_secsize) { + pfatal("%s: INVALID BLOCK FRAGMENTATION SIZE\n", dev); + return (0); + } fs->fs_nspf = DL_SECTOBLK(lp, fs->fs_fsize / lp->d_secsize); for (fs->fs_fsbtodb = 0, i = NSPF(fs); i > 1; i >>= 1) fs->fs_fsbtodb++;