From nobody Thu Sep 03 07:57:37 2026 X-Original-To: dev-commits-src-main@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4hbBlp72Tfz6qqby for ; Thu, 03 Sep 2026 07:57:42 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR2" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4hbBlp4Q34z3WVD for ; Thu, 03 Sep 2026 07:57:42 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1788422262; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=dIcGEYcwWzaH2W1ihBbsisp2ruV4iJJ1PZyfbRFppvg=; b=sqTgtB6F+uJ3HljsQD96w65jW+NuTxchNEORGbORLig1g4O92QQHuRFg6SUC/82IKjLWb1 mzSbQBR4tIQw4SovSLrtKPbsyoOvB7z7LMGpiYu3d8e4CK5I6mOz0yTW+mWc4hIESbdPzC +EtPOAUcUERunomDdMIhdrVs5P9XSYXSHBir8GQVM5+ft4Og3HZzMLfIROQk+pM1HkP8Bb aYk2rlc2qK8t+jaJ/BKrYLeL4NISo+JFpn6OOwo4lbIe/PfBqpu03khoRvcr+khHxwy6rn ATUzU4nJcjg6/3C77MGklcAhfWBsRwiRZRevXE4aerk0YG/o7qjUXop2x0hE9Q== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1788422262; a=rsa-sha256; cv=none; b=y2+bBPXA30IjAcRspPF5AXk+4o6cgZ9iibkLe1WNFddYUMjfyqdCfJhF/MHd/+ymxdJLMU DNeCldq3+AGBpDghk6DNpv1rdWPDAtfbtY0hXzdTwpjJXuCEErN6m1Pph7r7laQnJpKjCd COy0ha6cCVl3lMHqrv1OL5eSG8IluoqwXeCc6t+a5inocN6vfcLIY8Swv9AlVWJgkW2rT3 yoJmnuorn290Ak7VYhBxbO16kM6rv1YsY7SfHsD+lJAC1KOovnCelqYmNhLZHblyegedwQ Y0wz4E/i6TMb2M3TLHKCZWrY9PnWve+mVDXblkafXN84B9ccqUWpedJaovsC5w== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1788422262; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=dIcGEYcwWzaH2W1ihBbsisp2ruV4iJJ1PZyfbRFppvg=; b=fpVPgbYwDJva2XuKFdlN07k/1nycdbOn5gkPYQOoHPhxKzTO7zBa8c4JAjF8EarDVqTcH8 +T9cp8Z7tn2tLQQ8LC/oVfeHOH+uZ96mztZtU2ZQ2KLCXFtZHEnWhcB7Z1t5bosgR1pl1W CJSZI2eZdTOiBk3rlKtBx2/r77x9sOAuU/ZKvFsEnbiikeFOxsq+4GvrANfd9266PphEpN m8TE3o5RFs74bOQveFUQCOi2ctHj7ThVpCvEa3Vth0iYagBM7ol+TNJ3FgSIwtj4QFrRJy Xr58/S1yDxHAK9xyYiSn5vGOjGA00Z+nKITB3pX1p6PHPT1uzXHz6HjMS+v6mA== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4hbBlp3TXvz1KF0 for ; Thu, 03 Sep 2026 07:57:42 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 21139 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Thu, 03 Sep 2026 07:57:37 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org Cc: CooperCao From: Xin LI Subject: git: d3c5464fee7b - main - fsck_msdosfs: fix 32-bit overflow computing the LOST.DIR offset List-Id: Commit messages for the main branch of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-main List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-main@freebsd.org Sender: owner-dev-commits-src-main@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: delphij X-Git-Repository: src X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: d3c5464fee7b178a39c189363e48806a11fd3da4 Auto-Submitted: auto-generated Date: Thu, 03 Sep 2026 07:57:37 +0000 Message-Id: <6a992871.21139.5ba8ebdd@gitrepo.freebsd.org> The branch main has been updated by delphij: URL: https://cgit.FreeBSD.org/src/commit/?id=d3c5464fee7b178a39c189363e48806a11fd3da4 commit d3c5464fee7b178a39c189363e48806a11fd3da4 Author: CooperCao AuthorDate: 2026-09-03 07:10:12 +0000 Commit: Xin LI CommitDate: 2026-09-03 07:54:03 +0000 fsck_msdosfs: fix 32-bit overflow computing the LOST.DIR offset reconnect() computed the byte offset of the LOST.DIR cluster in 32-bit arithmetic and widened the result only on assignment: lfoff = (lfcl - CLUST_FIRST) * boot->ClusterSize + boot->FirstCluster * boot->bpbBytesPerSec; cl_t is u_int32_t and ClusterSize is u_int, so both products wrap modulo 2**32. Once LOST.DIR's cluster lies past the 4 GiB mark, lfoff aliases the offset exactly 4 GiB below it, which on such a volume is ordinary file data. That offset is used for both the read and the write: reconnect() reads a cluster of file data, scans it in 32-byte steps for a leading SLOT_EMPTY or SLOT_DELETED byte, which arbitrary data readily provides, stores the new directory entry in that slot, and writes the cluster back to the same wrong place. Thirty-two bytes of an unrelated file are silently replaced by a directory entry, and since that entry never reaches the real LOST.DIR the chain stays lost, so the next run damages another slot. Cast to off_t before multiplying. This was the only cluster-to-offset conversion multiplying a cluster number by the cluster size; the others in dir.c and fat.c compute a 32-bit sector number first and widen that, which cannot overflow because the sector count is itself 32-bit. The bug was observed in the field on a FAT32 stick where LOST.DIR had been created after a multi-gigabyte file was copied onto it, corrupting that file every time the volume was checked. MFC after: 1 week Pull Request: https://github.com/freebsd/freebsd-src/pull/2347 --- sbin/fsck_msdosfs/dir.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/sbin/fsck_msdosfs/dir.c b/sbin/fsck_msdosfs/dir.c index de3d950c9611..2ae0d8af4553 100644 --- a/sbin/fsck_msdosfs/dir.c +++ b/sbin/fsck_msdosfs/dir.c @@ -1129,8 +1129,8 @@ reconnect(struct fat_descriptor *fat, cl_t head, size_t length) lfcl = (lostDir->head < boot->NumClusters) ? lostDir->head : 0; return FSERROR; } - lfoff = (lfcl - CLUST_FIRST) * boot->ClusterSize - + boot->FirstCluster * boot->bpbBytesPerSec; + lfoff = (off_t)(lfcl - CLUST_FIRST) * boot->ClusterSize + + (off_t)boot->FirstCluster * boot->bpbBytesPerSec; if (lseek(dosfs, lfoff, SEEK_SET) != lfoff || (size_t)read(dosfs, lfbuf, boot->ClusterSize) != boot->ClusterSize) {