Bug 212114 - loader: zio_checksum_verify() must test spa for NULL pointer
Summary: loader: zio_checksum_verify() must test spa for NULL pointer
Status: Closed FIXED
Alias: None
Product: Base System
Classification: Unclassified
Component: kern (show other bugs)
Version: CURRENT
Hardware: Any Any
: --- Affects Many People
Assignee: Toomas Soome
URL:
Keywords:
: 212137 (view as bug list)
Depends on:
Blocks: 212038
  Show dependency tree / graph
 
Reported: 2016-08-24 15:28 UTC by Toomas Soome
Modified: 2016-08-25 13:10 UTC (History)
1 user (show)

See Also:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Toomas Soome freebsd_committer freebsd_triage 2016-08-24 15:28:10 UTC 
During the disks probing to discover the zfs pools, the loader will attempt to read the  pool label with NULL (uninitialized) spa. The normal loader operations do hide the issue, but userboot did reveal it by crashing bhyveload.
Comment 1 Toomas Soome freebsd_committer freebsd_triage 2016-08-24 15:33:45 UTC 
https://reviews.freebsd.org/D7634
Comment 2 commit-hook freebsd_committer freebsd_triage 2016-08-24 16:30:54 UTC 
A commit references this bug:

Author: tsoome
Date: Wed Aug 24 16:30:16 UTC 2016
New revision: 304753
URL: https://svnweb.freebsd.org/changeset/base/304753

Log:
  Bug 212114 - loader: zio_checksum_verify() must test spa for NULL pointer

  The issue was introduced with adding support for salted checksums, and
  was revealed by bhyve userboot.so.

  During pool discovery the loader is reading pool label from disks, and
  at that time the spa structure is not yet set up, so the NULL pointer
  is passed for spa. This condition must be checked to avoid the corruption
  of the memory and NULL pointer dereference.

  PR:		212114
  Reported by:	tsoome@freebsd.com
  Reviewed by:	allanjude
  Approved by:	allanjude (mentor)
  Differential Revision:	https://reviews.freebsd.org/D7634

Changes:
  head/sys/cddl/boot/zfs/zfssubr.c
Comment 3 Andrew Turner freebsd_committer freebsd_triage 2016-08-25 13:10:46 UTC 
*** Bug 212137 has been marked as a duplicate of this bug. ***