d/freebsd-dev
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

msdosfs: fixes for Undefined Behavior.

Browse Source 
These were found by the Undefined Behaviour GsoC project at NetBSD:

Do not change signedness bit with left shift.
While there avoid signed integer overflow.
Address both issues with using unsigned type.

msdosfs_fat.c:512:42, left shift of 1 by 31 places cannot be represented
in type 'int'
msdosfs_fat.c:521:44, left shift of 1 by 31 places cannot be represented
in type 'int'
msdosfs_fat.c:744:14, left shift of 1 by 31 places cannot be represented
in type 'int'
msdosfs_fat.c:744:24, signed integer overflow: -2147483648 - 1 cannot be
represented in type 'int [20]'
msdosfs_fat.c:840:13, left shift of 1 by 31 places cannot be represented
in type 'int'
msdosfs_fat.c:840:36, signed integer overflow: -2147483648 - 1 cannot be
represented in type 'int [20]'

Detected with micro-UBSan in the user mode.

Hinted from:	NetBSD (CVS 1.33)
MFC after:	2 weeks
Differenctial Revision:	https://reviews.freebsd.org/D16615
This commit is contained in:
Pedro F. Giffuni 2018-08-08 15:08:22 +00:00
parent d18ea344e6
commit c820acbf0a
Notes: svn2git 2020-12-20 02:59:44 +00:00 
svn path=/head/; revision=337456
1 changed files with 5 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
sys/fs/msdosfs/msdosfs_fat.c
View File

@ -391,7 +391,7 @@ usemap_alloc(struct msdosfsmount *pmp, u_long cn)
KASSERT((pmp->pm_inusemap[cn / N_INUSEBITS] & (1 << (cn % N_INUSEBITS)))
== 0, ("Allocating used sector %ld %ld %x", cn, cn % N_INUSEBITS,
(unsigned)pmp->pm_inusemap[cn / N_INUSEBITS]));
pmp->pm_inusemap[cn / N_INUSEBITS] |= 1 << (cn % N_INUSEBITS);
pmp->pm_inusemap[cn / N_INUSEBITS] |= 1U << (cn % N_INUSEBITS);
KASSERT(pmp->pm_freeclustercount > 0, ("usemap_alloc: too little"));
pmp->pm_freeclustercount--;
pmp->pm_flags |= MSDOSFS_FSIMOD;
@ -412,7 +412,7 @@ usemap_free(struct msdosfsmount *pmp, u_long cn)
KASSERT((pmp->pm_inusemap[cn / N_INUSEBITS] & (1 << (cn % N_INUSEBITS)))
!= 0, ("Freeing unused sector %ld %ld %x", cn, cn % N_INUSEBITS,
(unsigned)pmp->pm_inusemap[cn / N_INUSEBITS]));
pmp->pm_inusemap[cn / N_INUSEBITS] &= ~(1 << (cn % N_INUSEBITS));
pmp->pm_inusemap[cn / N_INUSEBITS] &= ~(1U << (cn % N_INUSEBITS));
}
int
@ -775,7 +775,7 @@ clusteralloc1(struct msdosfsmount *pmp, u_long start, u_long count,
for (cn = newst; cn <= pmp->pm_maxcluster;) {
idx = cn / N_INUSEBITS;
map = pmp->pm_inusemap[idx];
map |= (1 << (cn % N_INUSEBITS)) - 1;
map |= (1U << (cn % N_INUSEBITS)) - 1;
if (map != FULL_RUN) {
cn = idx * N_INUSEBITS + ffs(map ^ FULL_RUN) - 1;
if ((l = chainlength(pmp, cn, count)) >= count)
@ -792,7 +792,7 @@ clusteralloc1(struct msdosfsmount *pmp, u_long start, u_long count,
for (cn = 0; cn < newst;) {
idx = cn / N_INUSEBITS;
map = pmp->pm_inusemap[idx];
map |= (1 << (cn % N_INUSEBITS)) - 1;
map |= (1U << (cn % N_INUSEBITS)) - 1;
if (map != FULL_RUN) {
cn = idx * N_INUSEBITS + ffs(map ^ FULL_RUN) - 1;
if ((l = chainlength(pmp, cn, count)) >= count)
@ -950,7 +950,7 @@ fillinusemap(struct msdosfsmount *pmp)
for (cn = pmp->pm_maxcluster + 1; cn < (pmp->pm_maxcluster +
N_INUSEBITS) / N_INUSEBITS; cn++)
pmp->pm_inusemap[cn / N_INUSEBITS] |= 1 << (cn % N_INUSEBITS);
pmp->pm_inusemap[cn / N_INUSEBITS] |= 1U << (cn % N_INUSEBITS);
return (0);
}