git: d3c5464fee7b - main - fsck_msdosfs: fix 32-bit overflow computing the LOST.DIR offset

The branch main has been updated by delphij:

URL: https://cgit.FreeBSD.org/src/commit/?id=d3c5464fee7b178a39c189363e48806a11fd3da4

commit d3c5464fee7b178a39c189363e48806a11fd3da4
Author:     CooperCao <caopeng89@foxmail.com>
AuthorDate: 2026-09-03 07:10:12 +0000
Commit:     Xin LI <delphij@FreeBSD.org>
CommitDate: 2026-09-03 07:54:03 +0000

    fsck_msdosfs: fix 32-bit overflow computing the LOST.DIR offset
    
    reconnect() computed the byte offset of the LOST.DIR cluster in 32-bit
    arithmetic and widened the result only on assignment:
    
            lfoff = (lfcl - CLUST_FIRST) * boot->ClusterSize
                + boot->FirstCluster * boot->bpbBytesPerSec;
    
    cl_t is u_int32_t and ClusterSize is u_int, so both products wrap modulo
    2**32.  Once LOST.DIR's cluster lies past the 4 GiB mark, lfoff aliases
    the offset exactly 4 GiB below it, which on such a volume is ordinary
    file data.
    
    That offset is used for both the read and the write: reconnect() reads a
    cluster of file data, scans it in 32-byte steps for a leading SLOT_EMPTY
    or SLOT_DELETED byte, which arbitrary data readily provides, stores the
    new directory entry in that slot, and writes the cluster back to the
    same wrong place.  Thirty-two bytes of an unrelated file are silently
    replaced by a directory entry, and since that entry never reaches the
    real LOST.DIR the chain stays lost, so the next run damages another
    slot.
    
    Cast to off_t before multiplying.  This was the only cluster-to-offset
    conversion multiplying a cluster number by the cluster size; the others
    in dir.c and fat.c compute a 32-bit sector number first and widen that,
    which cannot overflow because the sector count is itself 32-bit.
    
    The bug was observed in the field on a FAT32 stick where LOST.DIR had
    been created after a multi-gigabyte file was copied onto it, corrupting
    that file every time the volume was checked.
    
    MFC after:      1 week
    Pull Request:   https://github.com/freebsd/freebsd-src/pull/2347
---
 sbin/fsck_msdosfs/dir.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/sbin/fsck_msdosfs/dir.c b/sbin/fsck_msdosfs/dir.c
index de3d950c9611..2ae0d8af4553 100644
--- a/sbin/fsck_msdosfs/dir.c
+++ b/sbin/fsck_msdosfs/dir.c
@@ -1129,8 +1129,8 @@ reconnect(struct fat_descriptor *fat, cl_t head, size_t length)
 			lfcl = (lostDir->head < boot->NumClusters) ? lostDir->head : 0;
 			return FSERROR;
 		}
-		lfoff = (lfcl - CLUST_FIRST) * boot->ClusterSize
-		    + boot->FirstCluster * boot->bpbBytesPerSec;
+		lfoff = (off_t)(lfcl - CLUST_FIRST) * boot->ClusterSize +
+		    (off_t)boot->FirstCluster * boot->bpbBytesPerSec;
 
 		if (lseek(dosfs, lfoff, SEEK_SET) != lfoff
 		    || (size_t)read(dosfs, lfbuf, boot->ClusterSize) != boot->ClusterSize) {