diff options
| author | Andriy Gapon <avg@FreeBSD.org> | 2010-04-02 15:22:23 +0000 |
|---|---|---|
| committer | Andriy Gapon <avg@FreeBSD.org> | 2010-04-02 15:22:23 +0000 |
| commit | 423b0fb7ad4deb81fb8bd8ad00514443789b930f (patch) | |
| tree | e885142d8e913f39c6b3ee3947dc31a54eb4a5bf /sys/fs | |
| parent | 1b4bc5f851fa99278416fcef5edcc80be0d23e40 (diff) | |
| download | src-423b0fb7ad4deb81fb8bd8ad00514443789b930f.tar.gz src-423b0fb7ad4deb81fb8bd8ad00514443789b930f.zip | |
mountmsdosfs: reject too high value of bytes per cluster
Bytes per cluster are calcuated as bytes per sector times sectors per
cluster. Too high value can overflow an internal variable with type
that can hold only values in valid range. Trying to use a wider type
results in an attempt to read more than MAXBSIZE at once, a panic.
Unfortunately, it is FreeBSD newfs_msdos that produces filesystems
with invalid parameters for certain types of media.
Reported by: Fabian Keil <freebsd-listen@fabiankeil.de>,
Paul B. Mahol <onemda@gmail.com>
Discussed with: bde, kib
MFC after: 1 week
X-ToDo: fix newfs_msdos
Notes
Notes:
svn path=/head/; revision=206098
Diffstat (limited to 'sys/fs')
| -rw-r--r-- | sys/fs/msdosfs/msdosfs_vfsops.c | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/sys/fs/msdosfs/msdosfs_vfsops.c b/sys/fs/msdosfs/msdosfs_vfsops.c index 77583eecd391..a0801bde22a5 100644 --- a/sys/fs/msdosfs/msdosfs_vfsops.c +++ b/sys/fs/msdosfs/msdosfs_vfsops.c @@ -580,6 +580,7 @@ mountmsdosfs(struct vnode *devvp, struct mount *mp) || (pmp->pm_BytesPerSec & (pmp->pm_BytesPerSec - 1)) || (pmp->pm_HugeSectors == 0) || (pmp->pm_FATsecs == 0) + || (SecPerClust * pmp->pm_BlkPerSec > MAXBSIZE / DEV_BSIZE) ) { error = EINVAL; goto error_exit; |