The branch main has been updated by delphij: URL: https://cgit.FreeBSD.org/src/commit/?id=d3c5464fee7b178a39c189363e48806a11fd3da4
commit d3c5464fee7b178a39c189363e48806a11fd3da4 Author: CooperCao <[email protected]> AuthorDate: 2026-09-03 07:10:12 +0000 Commit: Xin LI <[email protected]> CommitDate: 2026-09-03 07:54:03 +0000 fsck_msdosfs: fix 32-bit overflow computing the LOST.DIR offset reconnect() computed the byte offset of the LOST.DIR cluster in 32-bit arithmetic and widened the result only on assignment: lfoff = (lfcl - CLUST_FIRST) * boot->ClusterSize + boot->FirstCluster * boot->bpbBytesPerSec; cl_t is u_int32_t and ClusterSize is u_int, so both products wrap modulo 2**32. Once LOST.DIR's cluster lies past the 4 GiB mark, lfoff aliases the offset exactly 4 GiB below it, which on such a volume is ordinary file data. That offset is used for both the read and the write: reconnect() reads a cluster of file data, scans it in 32-byte steps for a leading SLOT_EMPTY or SLOT_DELETED byte, which arbitrary data readily provides, stores the new directory entry in that slot, and writes the cluster back to the same wrong place. Thirty-two bytes of an unrelated file are silently replaced by a directory entry, and since that entry never reaches the real LOST.DIR the chain stays lost, so the next run damages another slot. Cast to off_t before multiplying. This was the only cluster-to-offset conversion multiplying a cluster number by the cluster size; the others in dir.c and fat.c compute a 32-bit sector number first and widen that, which cannot overflow because the sector count is itself 32-bit. The bug was observed in the field on a FAT32 stick where LOST.DIR had been created after a multi-gigabyte file was copied onto it, corrupting that file every time the volume was checked. MFC after: 1 week Pull Request: https://github.com/freebsd/freebsd-src/pull/2347 --- sbin/fsck_msdosfs/dir.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/sbin/fsck_msdosfs/dir.c b/sbin/fsck_msdosfs/dir.c index de3d950c9611..2ae0d8af4553 100644 --- a/sbin/fsck_msdosfs/dir.c +++ b/sbin/fsck_msdosfs/dir.c @@ -1129,8 +1129,8 @@ reconnect(struct fat_descriptor *fat, cl_t head, size_t length) lfcl = (lostDir->head < boot->NumClusters) ? lostDir->head : 0; return FSERROR; } - lfoff = (lfcl - CLUST_FIRST) * boot->ClusterSize - + boot->FirstCluster * boot->bpbBytesPerSec; + lfoff = (off_t)(lfcl - CLUST_FIRST) * boot->ClusterSize + + (off_t)boot->FirstCluster * boot->bpbBytesPerSec; if (lseek(dosfs, lfoff, SEEK_SET) != lfoff || (size_t)read(dosfs, lfbuf, boot->ClusterSize) != boot->ClusterSize) {
