Files
mirror_zfs/module/zfs
c1ick ac6500389b zfs: add bounds checking to zil_parse (#16308)
Make sure log record don't stray beyond valid memory region.

There is a lack of verification of the space occupied by fixed members
of lr_t in the zil_parse.

We can create a crafted image to trigger an out of bounds read by
following these steps:
    1) Do some file operations and reboot to simulate abnormal exit
       without umount
    2) zil_chain.zc_nused: 0x1000
    3) First lr_t
       lr_t.lrc_txtype: 0x0
       lr_t.lrc_reclen: 0x1000-0xb8-0x1
       lr_t.lrc_txg: 0x0
       lr_t.lrc_seq: 0x1
    4) Update checksum in zil_chain.zc_eck

Fix:
Add some checks to make sure the remaining bytes are large enough to
hold an log record.

Signed-off-by: XDTG <click1799@163.com>
Reviewed-by: Alexander Motin <mav@FreeBSD.org>
Reviewed-by: Tony Hutter <hutter2@llnl.gov>
Reviewed-by: Brian Behlendorf <behlendorf1@llnl.gov>
2024-08-22 15:12:54 -07:00
..
2024-03-28 13:29:46 -07:00
2022-03-15 15:13:42 -07:00
2024-05-29 13:35:14 -07:00
2022-03-15 15:13:42 -07:00
2023-01-10 13:39:22 -08:00
2023-06-30 09:42:02 -07:00
2024-05-29 08:54:19 -07:00
2024-04-30 10:01:15 -07:00
2024-07-15 09:07:33 -07:00
2024-04-19 10:13:38 -07:00
2023-09-28 14:28:21 -07:00
2023-03-14 15:25:50 -07:00
2023-03-14 15:59:58 -07:00
2023-06-09 10:12:52 -07:00
2022-03-15 15:13:42 -07:00
2022-01-07 10:36:49 -08:00
2022-01-12 16:14:36 -08:00
2024-04-19 10:13:38 -07:00
2019-06-19 09:48:12 -07:00
2022-03-15 15:13:42 -07:00
2024-07-17 14:54:47 -07:00
2023-03-14 15:25:50 -07:00
2024-01-18 11:33:29 -08:00
2023-03-14 15:25:50 -07:00
2023-03-14 15:25:50 -07:00
2022-09-02 13:31:19 -07:00
2023-03-14 15:25:50 -07:00
2024-04-29 13:50:05 -07:00
2022-11-29 09:26:03 -08:00
2024-04-19 10:13:38 -07:00