git: 8435a9b20684 - main - Updates to UFS/FFS superblock integrity checks when reading a superblock.

From: Kirk McKusick <mckusick_at_FreeBSD.org>
Date: Thu, 17 Nov 2022 22:51:52 UTC
The branch main has been updated by mckusick:

URL: https://cgit.FreeBSD.org/src/commit/?id=8435a9b20684ba8bcda3df31d06b4d5eac9431a7

commit 8435a9b20684ba8bcda3df31d06b4d5eac9431a7
Author:     Kirk McKusick <mckusick@FreeBSD.org>
AuthorDate: 2022-11-17 22:50:27 +0000
Commit:     Kirk McKusick <mckusick@FreeBSD.org>
CommitDate: 2022-11-17 22:51:15 +0000

    Updates to UFS/FFS superblock integrity checks when reading a superblock.
    
    Further updates adding casts to avoid 32-bit multiplication overflow
    inspired by fixes in commit 017367c1146a69.
    
    No legitimate superblocks should fail as a result of these changes.
    
    Sponsored by: The FreeBSD Foundation
---
 sys/ufs/ffs/ffs_subr.c | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/sys/ufs/ffs/ffs_subr.c b/sys/ufs/ffs/ffs_subr.c
index b6b0be56fc73..67f4fcd92fd8 100644
--- a/sys/ufs/ffs/ffs_subr.c
+++ b/sys/ufs/ffs/ffs_subr.c
@@ -473,13 +473,15 @@ validate_sblock(struct fs *fs, int flags)
 	FCHK(fs->fs_fpg, <, 3 * fs->fs_frag, %jd);
 	FCHK(fs->fs_ncg, <, 1, %jd);
 	FCHK(fs->fs_ipg, <, fs->fs_inopb, %jd);
-	FCHK(fs->fs_ipg * fs->fs_ncg, >, (((int64_t)(1)) << 32) - INOPB(fs),
-	    %jd);
+	FCHK((u_int64_t)fs->fs_ipg * fs->fs_ncg, >,
+	    (((int64_t)(1)) << 32) - INOPB(fs), %jd);
 	FCHK(fs->fs_cstotal.cs_nifree, <, 0, %jd);
-	FCHK(fs->fs_cstotal.cs_nifree, >, fs->fs_ipg * fs->fs_ncg, %jd);
+	FCHK(fs->fs_cstotal.cs_nifree, >, (u_int64_t)fs->fs_ipg * fs->fs_ncg,
+	    %jd);
 	FCHK(fs->fs_cstotal.cs_ndir, <, 0, %jd);
 	FCHK(fs->fs_cstotal.cs_ndir, >,
-	    (fs->fs_ipg * fs->fs_ncg) - fs->fs_cstotal.cs_nifree, %jd);
+	    ((u_int64_t)fs->fs_ipg * fs->fs_ncg) - fs->fs_cstotal.cs_nifree,
+	    %jd);
 	FCHK(fs->fs_sbsize, >, SBLOCKSIZE, %jd);
 	FCHK(fs->fs_sbsize, <, (signed)sizeof(struct fs), %jd);
 	FCHK(fs->fs_maxbsize, <, fs->fs_bsize, %jd);