zfs
zfs copied to clipboard
Add bounds checking to zil_parse
Add bounds checking to zil_parse to ensure log records don't stray beyond valid memory region.
Motivation and Context
This change fixes the memory out of bounds issue mentioned in #16246.
Description
Before accessing the next log record header, check that there are enough bytes left to accommodate a log record. And ensure the lr->lrc_reclen
is appropriate.
How Has This Been Tested?
An error is returned when using the crafted image mentioned in the #16246.
root@syzkaller:~# /root/zfs/zpool import -d /root/zfs-poc.img myzpool
cannot import 'myzpool': one or more devices is currently unavailable
Types of changes
- [x] Bug fix (non-breaking change which fixes an issue)
- [ ] New feature (non-breaking change which adds functionality)
- [ ] Performance enhancement (non-breaking change which improves efficiency)
- [ ] Code cleanup (non-breaking change which makes code smaller or more readable)
- [ ] Breaking change (fix or feature that would cause existing functionality to change)
- [ ] Library ABI change (libzfs, libzfs_core, libnvpair, libuutil and libzfsbootenv)
- [ ] Documentation (a change to man pages or other documentation)
Checklist:
- [x] My code follows the OpenZFS code style requirements.
- [ ] I have updated the documentation accordingly.
- [ ] I have read the contributing document.
- [ ] I have added tests to cover my changes.
- [ ] I have run the ZFS Test Suite with this change applied.
- [x] All commit messages are properly formatted and contain
Signed-off-by
.