Differential D19220

Still a memory corruption bug in vdev_read in loader ZFS support
ClosedPublic
Actions

Authored by pkelsey on Feb 17 2019, 4:16 AM.

Tags

None

Referenced Files

	F171125432: D19220.id54005.diff
	Tue, Sep 8, 8:59 PM

	Unknown Object (File)
	Mon, Sep 7, 12:01 PM

	Unknown Object (File)
	Sat, Sep 5, 6:15 PM

	Unknown Object (File)
	Fri, Sep 4, 7:28 AM

	Unknown Object (File)
	Thu, Sep 3, 6:19 PM

	Unknown Object (File)
	Wed, Sep 2, 7:33 AM

	Unknown Object (File)
	Tue, Sep 1, 11:11 PM

	Unknown Object (File)
	Mon, Aug 31, 7:32 AM

View All Files

Subscribers

delphij

Details

Reviewers

allanjude
imp
tsoome

Commits

rS344234: It turns out r344226 narrowed the overrun bug but did not eliminate it entirely

Summary

D19140 didn't quite expunge the memory corruption bug in vdev_read() in zfs.c. In that fix, the single-sector case with non-zero tail would overrun the output buffer by the tail size.

Diff Detail

Repository

rS FreeBSD src repository - subversion

Lint

Lint Not Applicable

Unit

Tests Not Applicable

Event Timeline

pkelsey created this revision.Feb 17 2019, 4:16 AM

Herald added a subscriber: delphij. · View Herald TranscriptFeb 17 2019, 4:16 AM

tsoome accepted this revision.Feb 17 2019, 7:02 AM

This revision is now accepted and ready to land.Feb 17 2019, 7:02 AM

pkelsey retitled this revision from Still a memory corruption bug in vdev_readin loader ZFS support to Still a memory corruption bug in vdev_read in loader ZFS support.Feb 17 2019, 4:27 PM

allanjude accepted this revision.Feb 17 2019, 5:32 PM

Closed by commit rS344234: It turns out r344226 narrowed the overrun bug but did not eliminate it entirely (authored by pkelsey). · Explain WhyFeb 17 2019, 5:47 PM

This revision was automatically updated to reflect the committed changes.