⬢ DragonFlyBSD Kernel Audit
DF-3077 / fix.diff
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
--- a/sys/vfs/hammer/hammer_blockmap.c
+++ b/sys/vfs/hammer/hammer_blockmap.c
@@ -134,6 +134,13 @@
 	*errorp = 0;
 	blockmap = &hmp->blockmap[zone];
 	freemap = &hmp->blockmap[HAMMER_ZONE_FREEMAP_INDEX];
+	/* DF-3077: validate zone in production too; crafted vol0_blockmap
+	 * next_offset in a foreign zone must not allocate cross-zone. */
+	if (HAMMER_ZONE_DECODE(blockmap->next_offset) != zone) {
+		hmkprintf(hmp, "blockmap zone mismatch for zone %d\n", zone);
+		*errorp = EINVAL;
+		return (0);
+	}
 	KKASSERT(HAMMER_ZONE_DECODE(blockmap->next_offset) == zone);
 
 	/*
@@ -159,7 +166,7 @@
 	/*
 	 * Check for wrap
 	 */
-	if (next_offset == HAMMER_ZONE_ENCODE(zone + 1, 0)) {
+	if (next_offset >= HAMMER_ZONE_ENCODE(zone + 1, 0)) {	/* DF-3077: >= */
 		if (++loops == 2) {
 			hmkprintf(hmp, "No space left for zone %d "
 				"allocation\n", zone);
@@ -446,6 +453,13 @@
 		return(NULL);
 	blockmap = &hmp->blockmap[zone];
 	freemap = &hmp->blockmap[HAMMER_ZONE_FREEMAP_INDEX];
+	/* DF-3077: validate zone in production too; crafted vol0_blockmap
+	 * next_offset in a foreign zone must not allocate cross-zone. */
+	if (HAMMER_ZONE_DECODE(blockmap->next_offset) != zone) {
+		hmkprintf(hmp, "blockmap zone mismatch for zone %d\n", zone);
+		*errorp = EINVAL;
+		return (0);
+	}
 	KKASSERT(HAMMER_ZONE_DECODE(blockmap->next_offset) == zone);
 
 	/*
@@ -463,7 +477,7 @@
 	/*
 	 * Check for wrap
 	 */
-	if (next_offset == HAMMER_ZONE_ENCODE(zone + 1, 0)) {
+	if (next_offset >= HAMMER_ZONE_ENCODE(zone + 1, 0)) {	/* DF-3077: >= */
 		if (++loops == 2) {
 			hmkprintf(hmp, "No space left for zone %d "
 				"reservation\n", zone);