[Bug 258964] Mounting a corrupt FAT32 disk can cause a kernel page fault.

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=258964

            Bug ID: 258964
           Summary: Mounting a corrupt FAT32 disk can cause a kernel page
                    fault.
           Product: Base System
           Version: 13.0-RELEASE
          Hardware: Any
                OS: Any
            Status: New
          Severity: Affects Only Me
          Priority: ---
         Component: kern
          Assignee: bugs@FreeBSD.org
          Reporter: rtm@lcs.mit.edu
 Attachment #228483 text/plain
         mime type:

Created attachment 228483
  --> https://bugs.freebsd.org/bugzilla/attachment.cgi?id=228483&action=edit
A program to produce a corrupt FAT32 disk image.

I've attached a program that produces a corrupt FAT32 image that
causes a "fault on nofault entry" panic. The immediate cause is that
fillinusemap() calls bread() with size=0. The size=0 arises because
the FAT32 disk image specifies 16384 bytes per sector and 134217728
sectors per FAT; mountmsdosfs() multiplies these to produce
pm_FATsecs, which is 0x20000000000. fatblock() produces a minimum size
to read of pm_FATsecs, and fillinusemap() passes that size to bread().
However, bread()'s size argument is an int, so the 0x20000000000 is
truncated to zero.

You can see the image and crash:

% cc fat325.c
% ./a.out
% sudo mdconfig -f fat325.img
% sudo mount_msdosfs /dev/md0 /mnt
vm_fault_lookup: fault on nofault entry, addr: 0xfffffe0009f58000
cpuid = 0
time = 1633532887
KDB: stack backtrace:
#0 0xffffffff80c574c5 at kdb_backtrace+0x65
#1 0xffffffff80c09ea1 at vpanic+0x181
#2 0xffffffff80c09d13 at panic+0x43
#3 0xffffffff80f2898b at vm_fault+0x144b
#4 0xffffffff80f27461 at vm_fault_trap+0xb1
#5 0xffffffff8108b3b8 at trap_pfault+0x1f8
#6 0xffffffff8108a86d at trap+0x27d
#7 0xffffffff81061958 at calltrap+0x8
#8 0xffffffff80ab0e9b at msdosfs_mount+0xdeb
#9 0xffffffff80cda9b9 at vfs_domount+0x5e9
#10 0xffffffff80cd9bd7 at vfs_donmount+0x8e7
#11 0xffffffff80cd92b9 at sys_nmount+0x69
#12 0xffffffff8108babc at amd64_syscall+0x10c
#13 0xffffffff8106227e at fast_syscall_common+0xf8

My machine runs FreeBSD xxx 13.0-RELEASE-p4 FreeBSD 13.0-RELEASE-p4 #0: Tue Aug
24 07:33:27 UTC 2021    
root@amd64-builder.daemonology.net:/usr/obj/usr/src/amd64.amd64/sys/GENERIC 
amd64

-- 
You are receiving this mail because:
You are the assignee for the bug.