HomeFreeBSD

pseudofs: Fix a potential out-of-bounds access in pfs_lookup()

Description

pseudofs: Fix a potential out-of-bounds access in pfs_lookup()

pseudofs nodes store their name in a flexible array member, so the node
allocation is sized using the length of the name, including a nul
terminator. pfs_lookup() scans a directory of nodes, comparing names to
find a match. The comparison was incorrect and assumed that all node
names were at least as long as the name being looked up, which of course
isn't true.

I believe the bug is mostly harmless since it cannot result in false
positive or negative matches from the lookup, but it triggers a KASAN
check.

Reported by: pho
Reviewed by: kib, Olivier Certner <olce.freebsd@certner.fr>
MFC after: 2 weeks
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D40692

Details

Provenance
markjAuthored on Jun 23 2023, 1:54 PM
Reviewer
kib
Differential Revision
D40692: pseudofs: Fix a potential out-of-bounds access in pfs_lookup()
Parents
rG764464af4968: Fix spelling of "behavior" to be consistent with the rest of the file
Branches
Unknown
Tags
Unknown