Page MenuHomeFreeBSD

Audit userspace geom code for leaking memory to disk
ClosedPublic

Authored by cem on Sep 7 2017, 4:28 PM.
Tags
None
Referenced Files
Unknown Object (File)
Tue, Apr 28, 12:38 AM
Unknown Object (File)
Apr 20 2026, 12:36 PM
Unknown Object (File)
Apr 20 2026, 3:42 AM
Unknown Object (File)
Apr 19 2026, 1:17 PM
Unknown Object (File)
Apr 6 2026, 4:24 AM
Unknown Object (File)
Apr 5 2026, 2:07 AM
Unknown Object (File)
Mar 30 2026, 4:12 PM
Unknown Object (File)
Mar 29 2026, 2:51 AM

Details

Summary

Any geom class using g_metadata_store, as well as geom_virstor which duplicated
g_metadata_store internally, would dump sectorsize - mdsize bytes of userspace
memory following the metadata block stored. This is most or all geom classes
(gcache, gconcat, geli, gjournal, glabel, gmirror, gmultipath, graid3, gshsec,
gstripe, and geom_virstor).

PR is public so there is no point cloak-and-daggering this review. Security
team individuals are marked as reviewers.

PR: 222077

Diff Detail

Lint
Lint Passed
Unit
No Test Coverage
Build Status
Buildable 11416
Build 11775: arc lint + arc unit

Event Timeline

sbin/geom/class/part/geom_part.c
1277 ↗(On Diff #32768)

Oops. I see this change was unnecessary. I'll revert it.

cem marked an inline comment as done.

Drop unnecessary vtoc8 check. An appropriate check for that was already
present.

This revision is now accepted and ready to land.Sep 8 2017, 8:18 AM
This revision was automatically updated to reflect the committed changes.