Author: mckusick
Date: Sat Nov 26 00:43:38 2016
New Revision: 309172
URL: https://svnweb.freebsd.org/changeset/base/309172
Log:
MFC r308064:
Avoid possible overflow when calclating malloc size for auxillary
data structure sizes when mounting and reloading UFS/FFS filesystems.
Modified:
stable/11/sys/ufs/ffs/ffs_vfsops.c
Directory Properties:
stable/11/ (props changed)
Modified: stable/11/sys/ufs/ffs/ffs_vfsops.c
==============================================================================
--- stable/11/sys/ufs/ffs/ffs_vfsops.c Fri Nov 25 23:28:09 2016
(r309171)
+++ stable/11/sys/ufs/ffs/ffs_vfsops.c Sat Nov 26 00:43:38 2016
(r309172)
@@ -588,7 +588,8 @@ ffs_reload(struct mount *mp, struct thre
struct fs *fs, *newfs;
struct ufsmount *ump;
ufs2_daddr_t sblockloc;
- int i, blks, size, error;
+ int i, blks, error;
+ u_long size;
int32_t *lp;
ump = VFSTOUFS(mp);
@@ -658,7 +659,7 @@ ffs_reload(struct mount *mp, struct thre
size += fs->fs_ncg * sizeof(int32_t);
size += fs->fs_ncg * sizeof(u_int8_t);
free(fs->fs_csp, M_UFSMNT);
- space = malloc((u_long)size, M_UFSMNT, M_WAITOK);
+ space = malloc(size, M_UFSMNT, M_WAITOK);
fs->fs_csp = space;
for (i = 0; i < blks; i += fs->fs_frag) {
size = fs->fs_bsize;
@@ -751,7 +752,8 @@ ffs_mountfs(devvp, mp, td)
struct cdev *dev;
void *space;
ufs2_daddr_t sblockloc;
- int error, i, blks, size, ronly;
+ int error, i, blks, len, ronly;
+ u_long size;
int32_t *lp;
struct ucred *cred;
struct g_consumer *cp;
@@ -856,11 +858,11 @@ ffs_mountfs(devvp, mp, td)
/*
* Get journal provider name.
*/
- size = 1024;
- mp->mnt_gjprovider = malloc(size, M_UFSMNT, M_WAITOK);
- if (g_io_getattr("GJOURNAL::provider", cp, &size,
+ len = 1024;
+ mp->mnt_gjprovider = malloc((u_long)len, M_UFSMNT, M_WAITOK);
+ if (g_io_getattr("GJOURNAL::provider", cp, &len,
mp->mnt_gjprovider) == 0) {
- mp->mnt_gjprovider = realloc(mp->mnt_gjprovider, size,
+ mp->mnt_gjprovider = realloc(mp->mnt_gjprovider, len,
M_UFSMNT, M_WAITOK);
MNT_ILOCK(mp);
mp->mnt_flag |= MNT_GJOURNAL;
@@ -912,7 +914,7 @@ ffs_mountfs(devvp, mp, td)
if (fs->fs_contigsumsize > 0)
size += fs->fs_ncg * sizeof(int32_t);
size += fs->fs_ncg * sizeof(u_int8_t);
- space = malloc((u_long)size, M_UFSMNT, M_WAITOK);
+ space = malloc(size, M_UFSMNT, M_WAITOK);
fs->fs_csp = space;
for (i = 0; i < blks; i += fs->fs_frag) {
size = fs->fs_bsize;
@@ -997,8 +999,8 @@ ffs_mountfs(devvp, mp, td)
#endif
}
if ((fs->fs_flags & FS_TRIM) != 0) {
- size = sizeof(int);
- if (g_io_getattr("GEOM::candelete", cp, &size,
+ len = sizeof(int);
+ if (g_io_getattr("GEOM::candelete", cp, &len,
&ump->um_candelete) == 0) {
if (!ump->um_candelete)
printf("WARNING: %s: TRIM flag on fs but disk "
_______________________________________________
svn-src-all@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/svn-src-all
To unsubscribe, send any mail to "svn-src-all-unsubscr...@freebsd.org"
