From nobody Sun Jul 31 05:35:40 2022 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4LwVMw6PnXz4Y5P4; Sun, 31 Jul 2022 05:35:40 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4LwVMw5sbQz3tsr; Sun, 31 Jul 2022 05:35:40 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1659245740; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=t9HBRcQIKLSYM14tgg5ffn3sYdODkt3910oFKVdSUVc=; b=afJIPlHgifH5Nffxn62qJIhpprSVJrCZ1roibISc8n7wJRlowzN/ZE/+dRtIqtMktH8nmA nis7Oy4K6WKNvjZ27874842QMqsnhQiTsybo3myRp+H5NcIevQCJDDTktcHRMkn72DAjNp dhc1LdNawvbneVSKwium9+OVMmjFW37GL+VHUe9PW2rWmfkqzks5HYcVcv9EJyff9F4Pzi VGSlCkgdKptkEBWbCfb7TseZ/514Sr8O3YzUdfKcL+DX3F2sAOgHlKhKuhSMu5lL+1s2Mf wozpW9y9A9jgovaR9SJs9EsMczuYuqmmZVH/szzc2lmlba0MkC1V6oAcjwDZWw== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 4LwVMw4m7vzj0F; Sun, 31 Jul 2022 05:35:40 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.16.1/8.16.1) with ESMTP id 26V5ZeXn067317; Sun, 31 Jul 2022 05:35:40 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.16.1/8.16.1/Submit) id 26V5Zeqw067316; Sun, 31 Jul 2022 05:35:40 GMT (envelope-from git) Date: Sun, 31 Jul 2022 05:35:40 GMT Message-Id: <202207310535.26V5Zeqw067316@gitrepo.freebsd.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org From: Kirk McKusick Subject: git: 548045bf57c4 - main - Updates to UFS/FFS superblock integrity checks when reading a superblock. List-Id: Commit messages for all branches of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: Sender: owner-dev-commits-src-all@freebsd.org X-BeenThere: dev-commits-src-all@freebsd.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: mckusick X-Git-Repository: src X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: 548045bf57c46cb2f4d43d3d7fa5d8ad37ec7f9a Auto-Submitted: auto-generated ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1659245740; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=t9HBRcQIKLSYM14tgg5ffn3sYdODkt3910oFKVdSUVc=; b=Of6UVzgzkRoK2Ckh4PZIX3U/8d/x85DsAN21i2VfqvYCleC5Y4FH/znq2cdwajsYkA8ud5 heGLxUP9Acym/XcbSkq0vNZ6Qf+7JdkFe9xZhN6yNOT2glXjjQCTtH26Q3mSREzEcPUop5 LeHpHpMADROYaGtzfN52yUfR8jHcnzHm+ZeLWIkhJWj/Pu4OYqQooaLldf8xgJVTVJYibP RlDiiTHecEKpFIXxpYEHogBDBt4qt5wm10FdEQ1H5x5NmFIeoE/bBP0pG/fsy4aIcvO5Tn 5MR0nNPItTT/tRKP29rACsTcSeOZ1ygzT8Nl/wu5VHzAcsnOdKMetLf4GuMPKQ== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1659245740; a=rsa-sha256; cv=none; b=pgbtAzD49VEwOM8bdcPLEysziLwh6+FctARLefvO0JsqdisJQ5ubJIni00EjLqzYldI0es xBLt0Ah7PElUVfZrf1QsILzva1fbndIx26yBO+GIUOPShQ6gHK7tzbWP8tmbWXdZgS7cdN ZjYhd+9nY+mUSfmJFqXNpOBUkeReI1YtW9It73tAswWZY/jpLLbYxTs1CQ8f3wWQw1jNYL +s7Z8AnQaDOjYqmnCMXAK+sUNDciRh1C6mBJogoJsyT2tgAvwqfUUnvYLep5DdvE9Mtml+ eG4jtz0KTJmPuntANeuHEyI1C7tqvsIzQ+LffKOgG2LOt2C6kUGJ4JMxTfPLGg== ARC-Authentication-Results: i=1; mx1.freebsd.org; none X-ThisMailContainsUnwantedMimeParts: N The branch main has been updated by mckusick: URL: https://cgit.FreeBSD.org/src/commit/?id=548045bf57c46cb2f4d43d3d7fa5d8ad37ec7f9a commit 548045bf57c46cb2f4d43d3d7fa5d8ad37ec7f9a Author: Kirk McKusick AuthorDate: 2022-07-30 01:01:46 +0000 Commit: Kirk McKusick CommitDate: 2022-07-31 05:35:11 +0000 Updates to UFS/FFS superblock integrity checks when reading a superblock. Reorder a few checks to ensure fields have been checked before using them to check other fields. Add eight new checks mostly checking for non-negative values. No legitimate superblocks should fail as a result of these changes. --- sys/ufs/ffs/ffs_subr.c | 32 ++++++++++++++++++-------------- 1 file changed, 18 insertions(+), 14 deletions(-) diff --git a/sys/ufs/ffs/ffs_subr.c b/sys/ufs/ffs/ffs_subr.c index 1df3f878c4eb..502ef79c7bd3 100644 --- a/sys/ufs/ffs/ffs_subr.c +++ b/sys/ufs/ffs/ffs_subr.c @@ -340,7 +340,7 @@ readsuper(void *devfd, struct fs **fsp, off_t sblockloc, int isaltsblk, static int validate_sblock(struct fs *fs, int isaltsblk) { - u_long i, sectorsize, cgnum; + u_long i, sectorsize; u_int64_t maxfilesize, sizepb; sectorsize = dbtob(1); @@ -354,6 +354,7 @@ validate_sblock(struct fs *fs, int isaltsblk) sizeof(ufs2_daddr_t)), %jd); CHK(fs->fs_nindir, !=, fs->fs_bsize / sizeof(ufs2_daddr_t), %jd); + CHK(fs->fs_inopb, <, 1, %jd); CHK(fs->fs_inopb, !=, fs->fs_bsize / sizeof(struct ufs2_dinode), %jd); } else if (fs->fs_magic == FS_UFS1_MAGIC) { @@ -363,6 +364,7 @@ validate_sblock(struct fs *fs, int isaltsblk) } CHK(fs->fs_nindir, !=, fs->fs_bsize / sizeof(ufs1_daddr_t), %jd); + CHK(fs->fs_inopb, <, 1, %jd); CHK(fs->fs_inopb, !=, fs->fs_bsize / sizeof(struct ufs1_dinode), %jd); CHK(fs->fs_maxsymlinklen, !=, ((UFS_NDADDR + UFS_NIADDR) * @@ -390,12 +392,21 @@ validate_sblock(struct fs *fs, int isaltsblk) CHK(fs->fs_bsize, <, MINBSIZE, %jd); CHK(fs->fs_bsize, >, MAXBSIZE, %jd); CHK(fs->fs_bsize, <, roundup(sizeof(struct fs), DEV_BSIZE), %jd); - CHK(fs->fs_sbsize, >, SBLOCKSIZE, %jd); CHK(powerof2(fs->fs_bsize), ==, 0, %jd); + CHK(fs->fs_frag, <, 1, %jd); + CHK(fs->fs_frag, >, MAXFRAG, %jd); + CHK(fs->fs_frag, !=, numfrags(fs, fs->fs_bsize), %jd); CHK(fs->fs_fsize, <, sectorsize, %jd); - CHK(fs->fs_fsize, >, fs->fs_bsize, %jd); - CHK(fs->fs_fsize * MAXFRAG, <, fs->fs_bsize, %jd); + CHK(fs->fs_fsize * fs->fs_frag, !=, fs->fs_bsize, %jd); CHK(powerof2(fs->fs_fsize), ==, 0, %jd); + CHK(fs->fs_fpg, <, 3 * fs->fs_frag, %jd); + CHK(fs->fs_ncg, <, 1, %jd); + CHK(fs->fs_ipg, <, 1, %jd); + CHK(fs->fs_ipg * fs->fs_ncg, >, (((int64_t)(1)) << 32) - INOPB(fs), + %jd); + CHK(fs->fs_sblockloc, <, 0, %jd); + CHK(fs->fs_sblockloc, >, fs->fs_fpg, %jd); + CHK(fs->fs_sbsize, >, SBLOCKSIZE, %jd); CHK(fs->fs_maxbsize, <, fs->fs_bsize, %jd); CHK(powerof2(fs->fs_maxbsize), ==, 0, %jd); CHK(fs->fs_maxbsize, >, FS_MAXCONTIG * fs->fs_bsize, %jd); @@ -405,9 +416,7 @@ validate_sblock(struct fs *fs, int isaltsblk) CHK(fs->fs_qfmask, !=, ~fs->fs_fmask, %#jx); CHK(fs->fs_bshift, !=, ILOG2(fs->fs_bsize), %jd); CHK(fs->fs_fshift, !=, ILOG2(fs->fs_fsize), %jd); - CHK(fs->fs_frag, !=, numfrags(fs, fs->fs_bsize), %jd); CHK(fs->fs_fragshift, !=, ILOG2(fs->fs_frag), %jd); - CHK(fs->fs_frag, >, MAXFRAG, %jd); CHK(fs->fs_fsbtodb, !=, ILOG2(fs->fs_fsize / sectorsize), %jd); CHK(fs->fs_sblkno, !=, roundup( howmany(fs->fs_sblockloc + SBLOCKSIZE, fs->fs_fsize), @@ -417,8 +426,6 @@ validate_sblock(struct fs *fs, int isaltsblk) CHK(fs->fs_iblkno, !=, fs->fs_cblkno + fs->fs_frag, %jd); CHK(fs->fs_dblkno, !=, fs->fs_iblkno + fs->fs_ipg / INOPF(fs), %jd); CHK(fs->fs_cgsize, >, fs->fs_bsize, %jd); - CHK(fs->fs_cssize, !=, - fragroundup(fs, fs->fs_ncg * sizeof(struct csum)), %jd); /* * This test is valid, however older versions of growfs failed * to correctly update fs_dsize so will fail this test. Thus we @@ -449,19 +456,16 @@ validate_sblock(struct fs *fs, int isaltsblk) * that the summary information size is correct and that it starts * and ends in the data area of the same cylinder group. */ - CHK(fs->fs_ncg, <, 1, %jd); CHK(fs->fs_size, <, 8 * fs->fs_frag, %jd); CHK(fs->fs_size, <=, (fs->fs_ncg - 1) * fs->fs_fpg, %jd); CHK(fs->fs_size, >, fs->fs_ncg * fs->fs_fpg, %jd); + CHK(fs->fs_csaddr, <, 0, %jd); CHK(fs->fs_cssize, !=, fragroundup(fs, fs->fs_ncg * sizeof(struct csum)), %jd); CHK(dtog(fs, fs->fs_csaddr), >, fs->fs_ncg, %jd); - cgnum = dtog(fs, fs->fs_csaddr); - CHK(fs->fs_csaddr, <, cgdmin(fs, cgnum), %jd); + CHK(fs->fs_csaddr, <, cgdmin(fs, dtog(fs, fs->fs_csaddr)), %jd); CHK(dtog(fs, fs->fs_csaddr + howmany(fs->fs_cssize, fs->fs_fsize)), >, - cgnum, %jd); - CHK(fs->fs_ipg * fs->fs_ncg, >, (((int64_t)(1)) << 32) - INOPB(fs), - %jd); + dtog(fs, fs->fs_csaddr), %jd); /* * With file system clustering it is possible to allocate * many contiguous blocks. The kernel variable maxphys defines