Bug 258063 - Kernel panic from a corrupt cd9660 image.
Summary: Kernel panic from a corrupt cd9660 image.
Status: New
Alias: None
Product: Base System
Classification: Unclassified
Component: kern (show other bugs)
Version: CURRENT
Hardware: Any Any
: --- Affects Only Me
Assignee: freebsd-bugs (Nobody)
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2021-08-26 15:29 UTC by Robert Morris
Modified: 2021-09-11 03:35 UTC (History)
2 users (show)

See Also:


Attachments
mount_cd9660 of this image on a CD causes CURRENT to panic. (488.00 KB, application/octet-stream)
2021-08-26 15:29 UTC, Robert Morris
no flags Details

Note You need to log in before you can comment on or make changes to this bug.
Description Robert Morris 2021-08-26 15:29:11 UTC
Created attachment 227450 [details]
mount_cd9660 of this image on a CD causes CURRENT to panic.

If I write the attached file to a CD with cdrecord,
and then mount it on my amd64 machine, it panics. You can
also get the panic with

  # mdconfig -S 2048 -f bad2.iso
  # mount_cd9660 /dev/md0 /mnt

FreeBSD 14.0-CURRENT (GENERIC) #0 main-n248636-d20e9e02db3: Thu Aug 12 05:47:18 UTC 2021

panic: wrong offset -1099511604224 for sectorsize 2048
cpuid = 1
time = 1629984411
KDB: stack backtrace:
db_trace_self_wrapper() at db_trace_self_wrapper+0x2b/frame 0xfffffe0063ad1410
vpanic() at vpanic+0x187/frame 0xfffffe0063ad1470
panic() at panic+0x43/frame 0xfffffe0063ad14d0
g_io_request() at g_io_request+0x2ae/frame 0xfffffe0063ad1500
breadn_flags() at breadn_flags+0x1a3/frame 0xfffffe0063ad1570
cd9660_mount() at cd9660_mount+0x941/frame 0xfffffe0063ad1770
vfs_domount() at vfs_domount+0x8d8/frame 0xfffffe0063ad19e0
vfs_donmount() at vfs_donmount+0x880/frame 0xfffffe0063ad1a80
sys_nmount() at sys_nmount+0x69/frame 0xfffffe0063ad1ac0
amd64_syscall() at amd64_syscall+0x12e/frame 0xfffffe0063ad1bf0
fast_syscall_common() at fast_syscall_common+0xf8/frame 0xfffffe0063ad1bf0
--- syscall (378, FreeBSD ELF64, sys_nmount), rip = 0x8011abafa, rsp = 0x7fffffffe278, rbp = 0x7fffffffea20 ---
Comment 1 Graham Perrin 2021-09-05 16:30:33 UTC
Also: bug 130941