imrcpan/freebsd
1
0 Fork 0
mirror of https://github.com/freebsd/freebsd-src.git synced 2026-10-28 19:34:43 +01:00
Code Issues Packages Projects Releases Wiki Activity

ABD: Validate borrowed buffer length

Browse Source 
abd_borrow_buf() currently asserts that an unsigned size is at least
zero. This is tautological and allows a caller to borrow more bytes
than the ABD represents.

Assert that the ABD covers the requested length in the Linux, FreeBSD,
and libzpool implementations.

Reviewed-by: Brian Behlendorf <[email protected]>
Reviewed-by: Alexander Motin <[email protected]>
Signed-off-by: Kamil Monicz <[email protected]>
Closes #18811
This commit is contained in:
Kamil Monicz authored and GitHub committed 2026-07-16 09:40:04 -07:00
1 parent 9bf75b4b13
commit 5d530b8be1
3 files changed
+3 -3
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

lib/libzpool/abd_os.c
+1 -1
View File
@@ -376,7 +376,7 @@ abd_borrow_buf(abd_t *abd, size_t n)
{
void *buf;
abd_verify(abd);
ASSERT3U(abd->abd_size, >=, 0);
ASSERT3U(abd->abd_size, >=, n);
if (abd_is_linear(abd)) {
buf = abd_to_buf(abd);
} else {
module/os/freebsd/zfs/abd_os.c
+1 -1
View File
@@ -597,7 +597,7 @@ abd_borrow_buf(abd_t *abd, size_t n)
{
void *buf;
abd_verify(abd);
ASSERT3U(abd->abd_size, >=, 0);
ASSERT3U(abd->abd_size, >=, n);
if (abd_is_linear(abd)) {
buf = abd_to_buf(abd);
} else {
module/os/linux/zfs/abd_os.c
+1 -1
View File
@@ -981,7 +981,7 @@ abd_borrow_buf(abd_t *abd, size_t n)
{
void *buf;
abd_verify(abd);
ASSERT3U(abd->abd_size, >=, 0);
ASSERT3U(abd->abd_size, >=, n);
/*
* In the event the ABD is composed of a single user page from Direct
* I/O we can not direclty return the raw buffer. This is a consequence