Fix userland dereference NULL return value bugs
* `zstream_do_token()` does not handle failures from `libzfs_init()`
* `ztest_global_vars_to_zdb_args()` does not handle failures from
`calloc()`.
* `zfs_snapshot_nvl()` will pass an offset to a NULL pointer as a
source to `strlcpy()` if the provided nvlist is `NULL`.
We handle these by doing what the existing error handling does for other
errors involving these functions.
Coverity complained about these. It had complained about several more,
but one was fixed by 570ca4441e
and
another was a false positive. The remaining complaints labelled
"dereferece null return vaue" involve fetching things stored in
in-kernel data structures via `list_head()/list_next()`,
`AVL_PREV()/AVL_NEXT()` and `zfs_btree_find()`. Most of them occur in
void functions that have no error handling. They are much harder to
analyze than the two fixed in this patch, so they are left for a
follow-up patch.
Reviewed-by: Brian Behlendorf <behlendorf1@llnl.gov>
Reviewed-by: Ryan Moeller <ryan@iXsystems.com>
Signed-off-by: Richard Yao <richard.yao@alumni.stonybrook.edu>
Closes #13971
This commit is contained in:
parent
a36b37d4de
commit
67395be0c2
@ -49,6 +49,7 @@ int
|
||||
zstream_do_token(int argc, char *argv[])
|
||||
{
|
||||
char *resume_token = NULL;
|
||||
libzfs_handle_t *hdl;
|
||||
|
||||
if (argc < 2) {
|
||||
(void) fprintf(stderr, "Need to pass the resume token\n");
|
||||
@ -57,7 +58,10 @@ zstream_do_token(int argc, char *argv[])
|
||||
|
||||
resume_token = argv[1];
|
||||
|
||||
libzfs_handle_t *hdl = libzfs_init();
|
||||
if ((hdl = libzfs_init()) == NULL) {
|
||||
(void) fprintf(stderr, "%s\n", libzfs_error_init(errno));
|
||||
return (1);
|
||||
}
|
||||
|
||||
nvlist_t *resume_nvl =
|
||||
zfs_send_resume_token_to_nvlist(hdl, resume_token);
|
||||
|
@ -6637,6 +6637,8 @@ ztest_global_vars_to_zdb_args(void)
|
||||
{
|
||||
char **args = calloc(2*ztest_opts.zo_gvars_count + 1, sizeof (char *));
|
||||
char **cur = args;
|
||||
if (args == NULL)
|
||||
return (NULL);
|
||||
for (size_t i = 0; i < ztest_opts.zo_gvars_count; i++) {
|
||||
*cur++ = (char *)"-o";
|
||||
*cur++ = ztest_opts.zo_gvars[i];
|
||||
@ -6906,6 +6908,10 @@ ztest_run_zdb(const char *pool)
|
||||
ztest_get_zdb_bin(bin, len);
|
||||
|
||||
char **set_gvars_args = ztest_global_vars_to_zdb_args();
|
||||
if (set_gvars_args == NULL) {
|
||||
fatal(B_FALSE, "Failed to allocate memory in "
|
||||
"ztest_global_vars_to_zdb_args(). Cannot run zdb.\n");
|
||||
}
|
||||
char *set_gvars_args_joined = join_strings(set_gvars_args, " ");
|
||||
free(set_gvars_args);
|
||||
|
||||
|
@ -4164,6 +4164,8 @@ zfs_snapshot_nvl(libzfs_handle_t *hdl, nvlist_t *snaps, nvlist_t *props)
|
||||
* same pool, as does lzc_snapshot (below).
|
||||
*/
|
||||
elem = nvlist_next_nvpair(snaps, NULL);
|
||||
if (elem == NULL)
|
||||
return (-1);
|
||||
(void) strlcpy(pool, nvpair_name(elem), sizeof (pool));
|
||||
pool[strcspn(pool, "/@")] = '\0';
|
||||
zpool_hdl = zpool_open(hdl, pool);
|
||||
|
Loading…
Reference in New Issue
Block a user