diff options
| author | Tom Caputi <[email protected]> | 2018-02-22 11:50:14 -0500 |
|---|---|---|
| committer | Brian Behlendorf <[email protected]> | 2018-02-22 08:50:14 -0800 |
| commit | f8478fc2ca8d62f9562a4284426e8d3bd41c0cf0 (patch) | |
| tree | e6a7b4597b82719eb1a364b7f93918cd61eeeef4 /module/zfs | |
| parent | 09302a4ca86df2a758c5b883e28b0952cfa31ff7 (diff) | |
Fix bounds check in zio_crypt_do_objset_hmacs
The current bounds check in zio_crypt_do_objset_hmacs() does not
properly handle the possible sizes of the objset_phys_t and
can therefore read outside the buffer's memory. If that memory
happened to match what the check was actually looking for, the
objset would fail to be owned, complaining that the MAC was
invalid.
Reviewed-by: Brian Behlendorf <[email protected]>
Signed-off-by: Tom Caputi <[email protected]>
Closes #7210
Diffstat (limited to 'module/zfs')
| -rw-r--r-- | module/zfs/zio_crypt.c | 12 |
1 files changed, 8 insertions, 4 deletions
diff --git a/module/zfs/zio_crypt.c b/module/zfs/zio_crypt.c index 155bce9fb..d0b39a3f2 100644 --- a/module/zfs/zio_crypt.c +++ b/module/zfs/zio_crypt.c @@ -1196,13 +1196,17 @@ zio_crypt_do_objset_hmacs(zio_crypt_key_t *key, void *data, uint_t datalen, bcopy(raw_portable_mac, portable_mac, ZIO_OBJSET_MAC_LEN); /* - * The local MAC protects the user and group accounting. If these - * objects are not present, the local MAC is zeroed out. + * The local MAC protects the user, group and project accounting. + * If these objects are not present, the local MAC is zeroed out. */ - if (datalen >= OBJSET_PHYS_SIZE_V2 && + if ((datalen >= OBJSET_PHYS_SIZE_V3 && osp->os_userused_dnode.dn_type == DMU_OT_NONE && osp->os_groupused_dnode.dn_type == DMU_OT_NONE && - osp->os_projectused_dnode.dn_type == DMU_OT_NONE) { + osp->os_projectused_dnode.dn_type == DMU_OT_NONE) || + (datalen >= OBJSET_PHYS_SIZE_V2 && + osp->os_userused_dnode.dn_type == DMU_OT_NONE && + osp->os_groupused_dnode.dn_type == DMU_OT_NONE) || + (datalen <= OBJSET_PHYS_SIZE_V1)) { bzero(local_mac, ZIO_OBJSET_MAC_LEN); return (0); } |