Bug 204358
| Summary: | zfs loader zfs_probe_args secsz is too small, causing memory corruption | ||
|---|---|---|---|
| Product: | Base System | Reporter: | Toomas Soome <tsoome> |
| Component: | kern | Assignee: | Allan Jude <allanjude> |
| Status: | Closed FIXED | ||
| Severity: | Affects Many People | CC: | allanjude, avg |
| Priority: | --- | Keywords: | patch |
| Version: | CURRENT | ||
| Hardware: | Any | ||
| OS: | Any | ||
A commit references this bug: Author: allanjude Date: Mon Jan 11 15:35:30 UTC 2016 New revision: 293661 URL: https://svnweb.freebsd.org/changeset/base/293661 Log: DIOCGSECTORSIZE expects to write to a u_int, but struct zfs_probe_args member secsz was a uint16_t sys/boot/zfs/zfs.c has a probe args structure member, secsz, that is a uint16_t for media sector size; it is used as an argument for ioctl() at line 484. however, this ioctl writes 32 bits of data (u_int *) and therefore this ioctl will overwrite and corrupt 16 bits of memory. other use cases seem to use correct u_int type for secsz. PR: 204358 Submitted by: Toomas Soome <tsoome at me.com> Reviewed by: asomers, delphij, smh MFC after: 5 days Differential Revision: https://reviews.freebsd.org/D4811 Changes: head/sys/boot/zfs/zfs.c Assign to the committer. |
sys/boot/zfs/zfs.c has probe args structure including uint16_t secsz variable for media sector size; its used as an argument for ioctl() at line 484: ioctl(pa.fd, DIOCGSECTORSIZE, &pa.secsz); however, this ioctl is expecting 32bit data (u_int *) and therefore this ioctl will overwrite and corrupt 16bits of memory. other use cases seem to use correct u_int type for secsz. for fix the following fix should be sufficient. tsoome@beastie:/code/freebsd/head/sys/boot/zfs$ diff -u zfs.c.orig zfs.c --- zfs.c.orig N apr 16 14:49:00 2015 +++ zfs.c L nov 7 15:13:55 2015 @@ -399,7 +399,7 @@ int fd; const char *devname; uint64_t *pool_guid; - uint16_t secsz; + u_int secsz; }; static int