⬢ DragonFlyBSD Kernel Audit
DF-5151 / fix.diff
← back to finding ↓ download raw
diff --git a/sys/dev/disk/dm/dm_pdev.c b/sys/dev/disk/dm/dm_pdev.c
index 8c429e4e..1f6975be 100644
--- a/sys/dev/disk/dm/dm_pdev.c
+++ b/sys/dev/disk/dm/dm_pdev.c
@@ -125,6 +125,21 @@ dm_pdev_insert(const char *dev_name)
 
 	KKASSERT(dev_name != NULL);
 
+	/*
+	 * The pdev is keyed by name in a fixed DM_MAX_DEV_NAME (32) byte
+	 * field.  A longer path used to be silently truncated by
+	 * dm_pdev_alloc()'s strlcpy, which corrupts the dedup key: a later
+	 * insert whose path equals the truncated prefix strcmp-matches and
+	 * silently reuses this pdev, binding the new table to the WRONG
+	 * physical device.  Long paths also created duplicate pdev entries
+	 * under the same truncated key.  Reject them loudly instead.
+	 */
+	if (strlen(dev_name) >= DM_MAX_DEV_NAME) {
+		kprintf("dm_pdev_insert: device path too long (max %d): %s\n",
+		    DM_MAX_DEV_NAME - 1, dev_name);
+		return NULL;
+	}
+
 	lockmgr(&dm_pdev_mutex, LK_EXCLUSIVE);
 	dmp = dm_pdev_lookup_name(dev_name);