misc/70096: Full msdos file system causes corruption

[Amit Khivesara]

>Number:         70096
>Category:       misc
>Synopsis:       Full msdos file system causes corruption
>Confidential:   no
>Severity:       non-critical
>Priority:       medium
>Responsible:    freebsd-bugs
>State:          open
>Quarter:        
>Keywords:       
>Date-Required:
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Fri Aug 06 20:40:28 GMT 2004
>Closed-Date:
>Last-Modified:
>Originator:     Amit Khivesara
>Release:        4.9
>Organization:
Utstarcom
>Environment:
root at psyche.nj.us.utstar.com:/home/khivi/p4/mobo-R4.0/os/freebsd/kernel/DISKLESS  i386
>Description:
 When the file system gets full, then it stores a incorrect
 value of nxtfree into the disk fsinfo.

This will cause the assert in :
/*
     * Check and validate (or perhaps invalidate?) the fsinfo structure?
     */
    if (pmp->pm_fsinfo && pmp->pm_nxtfree > pmp->pm_maxcluster) {
        printf(
        "Next free cluster in FSInfo (%lu) exceeds maxcluster (%lu)\n",
            pmp->pm_nxtfree, pmp->pm_maxcluster);
        error = EINVAL;
        goto error_exit;
    }


to be fired.

--- 

 
>How-To-Repeat:
 Fill up msdos file system. Sync and reboot.


>Fix:
--- msdosfs_fat.c.orig  Wed Jun 16 11:16:37 2004
+++ msdosfs_fat.c       Wed Jun 16 11:15:41 2004
@@ -434,8 +434,9 @@
                        for (cn = 0; cn < pmp->pm_maxcluster; cn += N_INUSEBITS)
                                if (pmp->pm_inusemap[cn / N_INUSEBITS] != (u_int)-1)
                                        break;
-                       pmp->pm_nxtfree = cn
-                + ffs(pmp->pm_inusemap[cn / N_INUSEBITS]^(u_int)-1) - 1;
+                       pmp->pm_nxtfree = (cn < pmp->pm_maxcluster)?
+                       (cn + ffs(pmp->pm_inusemap[cn / N_INUSEBITS]^(u_int)-1) - 1)
+                       :0;
                }
                if (bread(pmp->pm_devvp, pmp->pm_fsinfo, fsi_size(pmp),
                    NOCRED, &bpn) != 0) {

>Release-Note:
>Audit-Trail:
>Unformatted: