[Bug 271414] negative root i-node size can cause crash in fsck_ffs's iblock() if journaling

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=271414

            Bug ID: 271414
           Summary: negative root i-node size can cause crash in
                    fsck_ffs's iblock() if journaling
           Product: Base System
           Version: CURRENT
          Hardware: Any
                OS: Any
            Status: New
          Severity: Affects Some People
          Priority: ---
         Component: bin
          Assignee: bugs@FreeBSD.org
          Reporter: rtm@lcs.mit.edu

Created attachment 242168
  --> https://bugs.freebsd.org/bugzilla/attachment.cgi?id=242168&action=edit
su+j ffs image with negative length for root i-node, causes fsck_ffs to crash

The attached file system image has a root inode with length that has
the high bit set. This causes howmany() in the iblock() code here
to be negative, but nif (being 32 bits) ends up positive and big, so the
"for (i = nif" passes a too-large i to IBLK().

        if (howmany(isize, sizepb) > NINDIR(&sblock))
                nif = NINDIR(&sblock);
        else
                nif = howmany(isize, sizepb);
        if (idesc->id_func == pass1check && nif < NINDIR(&sblock)) {
                for (i = nif; i < NINDIR(&sblock); i++) {
                        if (IBLK(bp, i) == 0)

Here's a backtrace from fsck -y on the attached gzipped image:

Program received signal SIGSEGV, Segmentation fault.
Address not mapped to object.
0x0000000000213ddc in iblock (idesc=0x7fffffffe7d0, isize=-9142367621260355008,
type=4) at inode.c:213
213                     if (IBLK(bp, i)) {
(gdb) where
#0  0x0000000000213ddc in iblock (idesc=0x7fffffffe7d0, 
    isize=-9142367621260355008, type=4) at inode.c:213
#1  0x000000000021333b in ckinode (dp=0x800a63b80, idesc=0x7fffffffe7d0)
    at inode.c:138
#2  0x000000000022526d in suj_check (filesys=0x7fffffffed74 "junk")
    at suj.c:2415
#3  0x00000000002195c6 in checkfilesys (filesys=0x7fffffffed74 "junk")
    at main.c:356
#4  0x0000000000218f72 in main (argc=1, argv=0x7fffffffea20) at main.c:210

-- 
You are receiving this mail because:
You are the assignee for the bug.