git: c79a1416955a - main - Updates to UFS/FFS superblock integrity checks when reading a superblock.

The branch main has been updated by mckusick:

URL: https://cgit.FreeBSD.org/src/commit/?id=c79a1416955a260424a5dd2013b114ff864bc926

commit c79a1416955a260424a5dd2013b114ff864bc926
Author:     Kirk McKusick <mckusick@FreeBSD.org>
AuthorDate: 2023-05-27 19:23:39 +0000
Commit:     Kirk McKusick <mckusick@FreeBSD.org>
CommitDate: 2023-05-27 19:24:11 +0000

    Updates to UFS/FFS superblock integrity checks when reading a superblock.
    
    Verify that the summary information does not extend past the end
    of the filesystem.
    
    No legitimate superblocks should fail as a result of these changes.
    
    Reported-by:  Robert Morris
    PR:           271351
    MFC-after:    1 week
    Sponsored-by: The FreeBSD Foundation
---
 sys/ufs/ffs/ffs_subr.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/sys/ufs/ffs/ffs_subr.c b/sys/ufs/ffs/ffs_subr.c
index 5b4ad96f4638..3959c3a7008b 100644
--- a/sys/ufs/ffs/ffs_subr.c
+++ b/sys/ufs/ffs/ffs_subr.c
@@ -443,7 +443,8 @@ validate_sblock(struct fs *fs, int flags)
 		FCHK(fs->fs_csaddr, <, 0, %jd);
 		FCHK(fs->fs_cssize, !=,
 		    fragroundup(fs, fs->fs_ncg * sizeof(struct csum)), %jd);
-		FCHK(dtog(fs, fs->fs_csaddr), >, fs->fs_ncg, %jd);
+		FCHK(fs->fs_csaddr + howmany(fs->fs_cssize, fs->fs_fsize), >,
+		    fs->fs_size, %jd);
 		FCHK(fs->fs_csaddr, <, cgdmin(fs, dtog(fs, fs->fs_csaddr)),
 		    %jd);
 		FCHK(dtog(fs, fs->fs_csaddr + howmany(fs->fs_cssize,
@@ -594,7 +595,8 @@ validate_sblock(struct fs *fs, int flags)
 	FCHK(fs->fs_csaddr, <, 0, %jd);
 	FCHK(fs->fs_cssize, !=,
 	    fragroundup(fs, fs->fs_ncg * sizeof(struct csum)), %jd);
-	FCHK(dtog(fs, fs->fs_csaddr), >, fs->fs_ncg, %jd);
+	FCHK(fs->fs_csaddr + howmany(fs->fs_cssize, fs->fs_fsize), >,
+	    fs->fs_size, %jd);
 	FCHK(fs->fs_csaddr, <, cgdmin(fs, dtog(fs, fs->fs_csaddr)), %jd);
 	FCHK(dtog(fs, fs->fs_csaddr + howmany(fs->fs_cssize, fs->fs_fsize)), >,
 	    dtog(fs, fs->fs_csaddr), %jd);