⬢ DragonFlyBSD Kernel Audit
DF-2647 / fix.diff
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
--- sys/vfs/hammer2/hammer2_ioctl.c.orig
+++ sys/vfs/hammer2/hammer2_ioctl.c
@@ -491,9 +491,24 @@
 		pfs->pfs_subtype = ripdata->meta.pfs_subtype;
 		pfs->pfs_clid = ripdata->meta.pfs_clid;
 		pfs->pfs_fsid = ripdata->meta.pfs_fsid;
-		KKASSERT(ripdata->meta.name_len < sizeof(pfs->name));
-		bcopy(ripdata->filename, pfs->name, ripdata->meta.name_len);
-		pfs->name[ripdata->meta.name_len] = 0;
+		{
+			size_t name_len = ripdata->meta.name_len;
+
+			/*
+			 * On-media field is a uint16 and must not be
+			 * trusted.  KKASSERT only protects INVARIANTS
+			 * builds; on production kernels an unchecked
+			 * name_len >= 256 overruns the 320-byte ioctl
+			 * buffer (kernel heap OOB write).  DF-2647.
+			 */
+			if (name_len >= sizeof(pfs->name)) {
+				kprintf("hammer2: pfs_get: corrupt name_len "
+					"%zu, clamped\n", name_len);
+				name_len = sizeof(pfs->name) - 1;
+			}
+			bcopy(ripdata->filename, pfs->name, name_len);
+			pfs->name[name_len] = 0;
+		}
 		ripdata = NULL;	/* safety */
 
 		/*