mirror_zfs/include
Ned Bass 43b4935e53 Prevent SA length overflow
The function sa_update() accepts a 32-bit length parameter and
assigns it to a 16-bit field in sa_bulk_attr_t, potentially
truncating the passed-in value. This could lead to corrupt system
attribute (SA) records getting written to the pool. Add a VERIFY to
sa_update() to detect cases where overflow would occur. The SA length
is limited to 16-bit values by the on-disk format defined by
sa_hdr_phys_t.

The function zfs_sa_set_xattr() is vulnerable to this bug if the
unpacked nvlist of xattrs is less than 64k in size but the packed
size is greater than 64k. Fix this by appropriately checking the
size of the packed nvlist before calling sa_update(). Add error
handling to zpl_xattr_set_sa() to keep the cached list of SA-based
xattrs consistent with the data on disk.

Lastly, zfs_sa_set_xattr() calls dmu_tx_abort() on an assigned
transaction if sa_update() returns an error, but the DMU only allows
unassigned transactions to be aborted. Wrap the sa_update() call in a
VERIFY0, remove the transaction abort, and call dmu_tx_commit()
unconditionally. This is consistent practice with other callers
of sa_update().

Signed-off-by: Ned Bass <bass6@llnl.gov>
Signed-off-by: Brian Behlendorf <behlendorf1@llnl.gov>
Signed-off-by: Richard Yao <ryao@gentoo.org>
Closes #4150
2015-12-30 13:20:12 -08:00
..
linux Use uio for zvol_{read,write} 2015-12-15 16:21:43 -08:00
sys Prevent SA length overflow 2015-12-30 13:20:12 -08:00
libnvpair.h Support custom build directories and move includes 2010-09-08 12:38:56 -07:00
libuutil_common.h Support custom build directories and move includes 2010-09-08 12:38:56 -07:00
libuutil_impl.h Support custom build directories and move includes 2010-09-08 12:38:56 -07:00
libuutil.h Support custom build directories and move includes 2010-09-08 12:38:56 -07:00
libzfs_core.h Illumos 5027 - zfs large block support 2015-05-11 12:23:16 -07:00
libzfs_impl.h Illumos 4368, 4369. 2014-07-29 10:55:29 -07:00
libzfs.h Illumos 5745 - zfs set allows only one dataset property to be set at a time 2015-12-29 16:59:26 -08:00
Makefile.am Kernel header installation should respect --prefix 2014-10-28 09:37:06 -07:00
zfeature_common.h Illumos 5959 - clean up per-dataset feature count code 2015-12-04 14:20:20 -08:00
zfs_comutil.h Illumos #2882, #2883, #2900 2013-09-04 15:49:00 -07:00
zfs_deleg.h Illumos 4368, 4369. 2014-07-29 10:55:29 -07:00
zfs_fletcher.h Support custom build directories and move includes 2010-09-08 12:38:56 -07:00
zfs_namecheck.h Illumos 4368, 4369. 2014-07-29 10:55:29 -07:00
zfs_prop.h Check the dataset type more rigorously when fetching properties. 2014-05-06 10:41:46 -07:00
zpios-ctl.h Add large block support to zpios(1) benchmark 2015-09-22 09:13:20 -07:00
zpios-internal.h Add large block support to zpios(1) benchmark 2015-09-22 09:13:20 -07:00