From 63c23c3314412a66b4af7999f8cb6556683e0e43 Mon Sep 17 00:00:00 2001 From: mckusick Date: Sat, 22 Mar 2014 11:43:35 +0000 Subject: [PATCH] MFC of 263062: Avoid segment fault when attempting to clean up cylinder group buffer cache. PR: 187221 Submitted by: Petr Lampa Obtained from: Petr Lampa MFC after: 1 week MFC of 262488: Arguments for malloc and calloc should be size_t, not int. Use proper bounds check when trying to free cached memory. Spotted by: Xin Li Tested by: Dmitry Sivachenko MFC after: 2 weeks git-svn-id: svn://svn.freebsd.org/base/stable/10@263629 ccf9f872-aa2e-dd11-9fc8-001c23d0bc1f --- sbin/fsck_ffs/fsck.h | 4 ++-- sbin/fsck_ffs/fsutil.c | 18 +++++++++++------- 2 files changed, 13 insertions(+), 9 deletions(-) diff --git a/sbin/fsck_ffs/fsck.h b/sbin/fsck_ffs/fsck.h index a7b5961a5..c0ec65137 100644 --- a/sbin/fsck_ffs/fsck.h +++ b/sbin/fsck_ffs/fsck.h @@ -369,7 +369,7 @@ int flushentry(void); * to get space. */ static inline void* -Malloc(int size) +Malloc(size_t size) { void *retval; @@ -384,7 +384,7 @@ Malloc(int size) * to get space. */ static inline void* -Calloc(int cnt, int size) +Calloc(size_t cnt, size_t size) { void *retval; diff --git a/sbin/fsck_ffs/fsutil.c b/sbin/fsck_ffs/fsutil.c index 4b44fd4ec..bc80e2f3e 100644 --- a/sbin/fsck_ffs/fsutil.c +++ b/sbin/fsck_ffs/fsutil.c @@ -225,7 +225,7 @@ cgget(int cg) struct cg *cgp; if (cgbufs == NULL) { - cgbufs = Calloc(sblock.fs_ncg, sizeof(struct bufarea)); + cgbufs = calloc(sblock.fs_ncg, sizeof(struct bufarea)); if (cgbufs == NULL) errx(EEXIT, "cannot allocate cylinder group buffers"); } @@ -254,6 +254,8 @@ flushentry(void) { struct bufarea *cgbp; + if (flushtries == sblock.fs_ncg || cgbufs == NULL) + return (0); cgbp = &cgbufs[flushtries++]; if (cgbp->b_un.b_cg == NULL) return (0); @@ -434,13 +436,15 @@ ckfini(int markclean) } if (numbufs != cnt) errx(EEXIT, "panic: lost %d buffers", numbufs - cnt); - for (cnt = 0; cnt < sblock.fs_ncg; cnt++) { - if (cgbufs[cnt].b_un.b_cg == NULL) - continue; - flush(fswritefd, &cgbufs[cnt]); - free(cgbufs[cnt].b_un.b_cg); + if (cgbufs != NULL) { + for (cnt = 0; cnt < sblock.fs_ncg; cnt++) { + if (cgbufs[cnt].b_un.b_cg == NULL) + continue; + flush(fswritefd, &cgbufs[cnt]); + free(cgbufs[cnt].b_un.b_cg); + } + free(cgbufs); } - free(cgbufs); pbp = pdirbp = (struct bufarea *)0; if (cursnapshot == 0 && sblock.fs_clean != markclean) { if ((sblock.fs_clean = markclean) != 0) { -- 2.45.0