[Bug 270587] FAT12 with non-default parameters panics on mount

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=270587

            Bug ID: 270587
           Summary: FAT12 with non-default parameters panics on mount
           Product: Base System
           Version: CURRENT
          Hardware: Any
                OS: Any
            Status: New
          Severity: Affects Some People
          Priority: ---
         Component: kern
          Assignee: bugs@FreeBSD.org
          Reporter: se@FreeBSD.org

The following sequence of commands leads to a panic due to a page fault in the
kernel:

# mdconfig -s 64m
md0

# newfs_msdos -F 12 -n 2 -e 128 -S 4096 -c 2 md0
newfs_msdos: cannot get number of sectors per track: Operation not supported
newfs_msdos: cannot get number of heads: Operation not supported
newfs_msdos: debug: cls=4084 x1=6 SecPerClust=2

newfs_msdos: warning: FAT type limits file system to 8175 sectors
/dev/md0: 8168 sectors in 4084 FAT12 clusters (8192 bytes/cluster)
BytesPerSec=4096 SecPerClust=2 ResSectors=1 FATs=2 RootDirEnts=128 Sectors=8175
Media=0xf0 FATsecs=2 SecPerTrack=63 Heads=1 HiddenSecs=0

# mount -t msdosfs /dev/md0 /mnt

The cause is the fact that a FAT entry crosses the boundary between the 1st and
2nd FAT sector (byte offset 4095 is the last byte in the 1st sector and 4096
the first byte in the 2nd sector). This reads 1 byte beyond the page allocated
for the 1st sector.

There are other issues, with less drastic consequences, e.g.:

# newfs_msdos -F 12 -s 64m -n 2 -e 1024 -S 512
newfs_msdos: cannot get number of sectors per track: Operation not supported
newfs_msdos: cannot get number of heads: Operation not supported
newfs_msdos: warning: FAT type limits file system to 32768 sectors
/dev/md1: 32672 sectors in 4084 FAT12 clusters (4096 bytes/cluster)
BytesPerSec=512 SecPerClust=8 ResSectors=1 FATs=2 RootDirEnts=1024
Sectors=32768 Media=0xf0 FATsecs=12 SecPerTrack=63 Heads=16 HiddenSecs=0

# df -i /mnt
Filesystem 1K-blocks Used Avail Capacity iused ifree %iused  Mounted on
/dev/md1       12288    8 12280     0%       0  1024    0%   /mnt

# mount -t msdosfs /dev/md0 /mnt

# ls -lsd /mnt
32 drwxr-xr-x  1 root  wheel  32768 Jan  1  1980 /mnt/

# dd if=/dev/zero of=/mnt/TEST.DAT bs=1k count=12288
dd: /mnt/TEST.DAT: No space left on device
12281+0 records in
12280+0 records out
12574720 bytes transferred in 0.013075 secs (961691614 bytes/sec)

This file system has 4084 clusters of 4 KB (or roughly 16 MB), but df shows the
total size of the data area as only 12288 KB (12 MB), but trying to write a
file of size 12 MB results in an error since apparently 8 KB have already been
allocated (for the FAT sectors that actually exist outside the data area), and
"ls -lask /mnt" shows a "." entry with an apparent size of 32 KB (which also
are allocated outside the data area).

-- 
You are receiving this mail because:
You are the assignee for the bug.