zfs icon indicating copy to clipboard operation
zfs copied to clipboard

Add bounds checking to zil_parse

Open XDTG opened this issue 8 months ago • 4 comments

Add bounds checking to zil_parse to ensure log records don't stray beyond valid memory region.

Motivation and Context

This change fixes the memory out of bounds issue mentioned in #16246.

Description

Before accessing the next log record header, check that there are enough bytes left to accommodate a log record. And ensure the lr->lrc_reclen is appropriate.

How Has This Been Tested?

An error is returned when using the crafted image mentioned in the #16246.

root@syzkaller:~# /root/zfs/zpool import -d /root/zfs-poc.img myzpool
cannot import 'myzpool': one or more devices is currently unavailable

Types of changes

  • [x] Bug fix (non-breaking change which fixes an issue)
  • [ ] New feature (non-breaking change which adds functionality)
  • [ ] Performance enhancement (non-breaking change which improves efficiency)
  • [ ] Code cleanup (non-breaking change which makes code smaller or more readable)
  • [ ] Breaking change (fix or feature that would cause existing functionality to change)
  • [ ] Library ABI change (libzfs, libzfs_core, libnvpair, libuutil and libzfsbootenv)
  • [ ] Documentation (a change to man pages or other documentation)

Checklist:

  • [x] My code follows the OpenZFS code style requirements.
  • [ ] I have updated the documentation accordingly.
  • [ ] I have read the contributing document.
  • [ ] I have added tests to cover my changes.
  • [ ] I have run the ZFS Test Suite with this change applied.
  • [x] All commit messages are properly formatted and contain Signed-off-by.

XDTG avatar Jun 28 '24 08:06 XDTG