Bug 28536
| Summary: | writing to corrupted msdosfs causes kernel panic | ||||||
|---|---|---|---|---|---|---|---|
| Product: | Base System | Reporter: | jyliu <jyliu> | ||||
| Component: | i386 | Assignee: | Tom Rhodes <trhodes> | ||||
| Status: | Closed FIXED | ||||||
| Severity: | Affects Only Me | ||||||
| Priority: | Normal | ||||||
| Version: | 4.3-STABLE | ||||||
| Hardware: | Any | ||||||
| OS: | Any | ||||||
| Attachments: |
|
||||||
I think, this should be noted by the MSDOSFS maintainer. --Hiten State Changed From-To: open->patched Just applied a patch to CURRENT which should fix this problem. With no problems I'll MFC in a week. Thanks Responsible Changed From-To: freebsd-bugs->trhodes Just applied a patch to CURRENT which should fix this problem. With no problems I'll MFC in a week. Thanks State Changed From-To: patched->feedback Applied to STABLE, please let me know if you still have problems. State Changed From-To: feedback->closed Closed. I can not reproduce this, and it has been in the feedback state for awhile now. |
In -current and -stable, mountmsdosfs()@ msdosfs_vfsops.c doesn't not check if pm_nxtfree exceeds the max cluster in the file system. So if a corrupted msdos filesystem(which is not uncommon) is written, the following code in updatefats()@msdosfs_fat.c will generate a panic. u_long cn = pmp->pm_nxtfree; if (pmp->pm_freeclustercount && (pmp->pm_inusemap[cn / N_INUSEBITS] & (1 << (cn % N_INUSEBITS)))) { .... } Fix: Apply the following patch to test if next free cluster exceeds the max cluster in mountmsdosfs(). How-To-Repeat: Mount a corrupted msdos filesystem(e.g. not probably shutdown) and write to it.