Audit userspace geom code for leaking memory to disk

Any geom class using g_metadata_store, as well as geom_virstor which
duplicated g_metadata_store internally, would dump sectorsize - mdsize bytes
of userspace memory following the metadata block stored. This is most or all
geom classes (gcache, gconcat, geli, gjournal, glabel, gmirror, gmultipath,
graid3, gshsec, gstripe, and geom_virstor).

PR:		222077 (comment #3)
Reported by:	Maxim Khitrov <max AT mxcrypt.com>
Reviewed by:	des
Security:	yes
Sponsored by:	Dell EMC Isilon
Differential Revision:	https://reviews.freebsd.org/D12269
This commit is contained in:
Conrad Meyer 2017-09-08 15:08:17 +00:00
parent dc63dc00cb
commit 0bd816f211
2 changed files with 2 additions and 0 deletions

View File

@ -183,6 +183,7 @@ my_g_metadata_store(const char *name, u_char *md, size_t size)
goto out;
}
bcopy(md, sector, size);
bzero(sector + size, sectorsize - size);
if (pwrite(fd, sector, sectorsize, mediasize - sectorsize) !=
(ssize_t)sectorsize) {
error = errno;

View File

@ -302,6 +302,7 @@ g_metadata_store(const char *name, const unsigned char *md, size_t size)
goto out;
}
bcopy(md, sector, size);
bzero(sector + size, sectorsize - size);
if (pwrite(fd, sector, sectorsize, mediasize - sectorsize) !=
sectorsize) {
error = errno;