svn commit: r308551 - stable/10/sys/fs/msdosfs

[Konstantin Belousov]

Author: kib
Date: Fri Nov 11 20:06:07 2016
New Revision: 308551
URL: https://svnweb.freebsd.org/changeset/base/308551

Log:
  MFC r308024:
  Ensure that cluster allocations never allocate clusters outside the
  volume limits.

Modified:
  stable/10/sys/fs/msdosfs/msdosfs_fat.c
Directory Properties:
  stable/10/   (props changed)

Modified: stable/10/sys/fs/msdosfs/msdosfs_fat.c
==============================================================================
--- stable/10/sys/fs/msdosfs/msdosfs_fat.c	Fri Nov 11 20:04:19 2016	(r308550)
+++ stable/10/sys/fs/msdosfs/msdosfs_fat.c	Fri Nov 11 20:06:07 2016	(r308551)
@@ -401,6 +401,8 @@ usemap_alloc(pmp, cn)
 
 	MSDOSFS_ASSERT_MP_LOCKED(pmp);
 
+	KASSERT(cn <= pmp->pm_maxcluster, ("cn too large %lu %lu", cn,
+	    pmp->pm_maxcluster));
 	KASSERT((pmp->pm_flags & MSDOSFSMNT_RONLY) == 0,
 	    ("usemap_alloc on ro msdosfs mount"));
 	KASSERT((pmp->pm_inusemap[cn / N_INUSEBITS] & (1 << (cn % N_INUSEBITS)))
@@ -419,6 +421,9 @@ usemap_free(pmp, cn)
 {
 
 	MSDOSFS_ASSERT_MP_LOCKED(pmp);
+
+	KASSERT(cn <= pmp->pm_maxcluster, ("cn too large %lu %lu", cn,
+	    pmp->pm_maxcluster));
 	KASSERT((pmp->pm_flags & MSDOSFSMNT_RONLY) == 0,
 	    ("usemap_free on ro msdosfs mount"));
 	pmp->pm_freeclustercount++;
@@ -672,6 +677,8 @@ chainlength(pmp, start, count)
 
 	MSDOSFS_ASSERT_MP_LOCKED(pmp);
 
+	if (start > pmp->pm_maxcluster)
+		return (0);
 	max_idx = pmp->pm_maxcluster / N_INUSEBITS;
 	idx = start / N_INUSEBITS;
 	start %= N_INUSEBITS;
@@ -679,11 +686,18 @@ chainlength(pmp, start, count)
 	map &= ~((1 << start) - 1);
 	if (map) {
 		len = ffs(map) - 1 - start;
-		return (len > count ? count : len);
+		len = MIN(len, count);
+		if (start + len > pmp->pm_maxcluster)
+			len = pmp->pm_maxcluster - start + 1;
+		return (len);
 	}
 	len = N_INUSEBITS - start;
-	if (len >= count)
-		return (count);
+	if (len >= count) {
+		len = count;
+		if (start + len > pmp->pm_maxcluster)
+			len = pmp->pm_maxcluster - start + 1;
+		return (len);
+	}
 	while (++idx <= max_idx) {
 		if (len >= count)
 			break;
@@ -694,7 +708,10 @@ chainlength(pmp, start, count)
 		}
 		len += N_INUSEBITS;
 	}
-	return (len > count ? count : len);
+	len = MIN(len, count);
+	if (start + len > pmp->pm_maxcluster)
+		len = pmp->pm_maxcluster - start + 1;
+	return (len);
 }
 
 /*
@@ -961,6 +978,11 @@ fillinusemap(pmp)
 	}
 	if (bp != NULL)
 		brelse(bp);
+
+	for (cn = pmp->pm_maxcluster + 1; cn < (pmp->pm_maxcluster +
+	    N_INUSEBITS) / N_INUSEBITS; cn++)
+		pmp->pm_inusemap[cn / N_INUSEBITS] |= 1 << (cn % N_INUSEBITS);
+
 	return (0);
 }