Date: Thu, 9 Nov 2017 18:06:18 +0000 (UTC) From: Andriy Gapon <avg@FreeBSD.org> To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-vendor@freebsd.org Subject: svn commit: r325605 - vendor-sys/illumos/dist/common/zfs Message-ID: <201711091806.vA9I6ISI011626@repo.freebsd.org>
next in thread | raw e-mail | index | archive | help
Author: avg Date: Thu Nov 9 18:06:18 2017 New Revision: 325605 URL: https://svnweb.freebsd.org/changeset/base/325605 Log: 8713 Buffer overflow in dsl_dataset_name() illumos/illumos-gate@f37ae9a714b97eca91c74c680c20c750c7cf5c02 https://github.com/illumos/illumos-gate/commit/f37ae9a714b97eca91c74c680c20c750c7cf5c02 https://www.illumos.org/issues/8713 If we're creating a pool with version >= SPA_VERSION_DSL_SCRUB (v11) we need to account for additional space needed by the origin dataset which will also be snapshotted: "poolname"+"/"+"$ORIGIN"+"@"+"$ORIGIN". Enforce this limit in pool_namecheck(). Reviewed by: Prakash Surya <prakash.surya@delphix.com> Reviewed by: Matthew Ahrens <mahrens@delphix.com> Approved by: Dan McDonald <danmcd@joyent.com> Author: loli10K <ezomori.nozomu@gmail.com> Modified: vendor-sys/illumos/dist/common/zfs/zfs_namecheck.c Modified: vendor-sys/illumos/dist/common/zfs/zfs_namecheck.c ============================================================================== --- vendor-sys/illumos/dist/common/zfs/zfs_namecheck.c Thu Nov 9 17:58:57 2017 (r325604) +++ vendor-sys/illumos/dist/common/zfs/zfs_namecheck.c Thu Nov 9 18:06:18 2017 (r325605) @@ -44,6 +44,7 @@ #include <string.h> #endif +#include <sys/dsl_dir.h> #include <sys/param.h> #include <sys/nvpair.h> #include "zfs_namecheck.h" @@ -301,8 +302,14 @@ pool_namecheck(const char *pool, namecheck_err_t *why, /* * Make sure the name is not too long. + * If we're creating a pool with version >= SPA_VERSION_DSL_SCRUB (v11) + * we need to account for additional space needed by the origin ds which + * will also be snapshotted: "poolname"+"/"+"$ORIGIN"+"@"+"$ORIGIN". + * Play it safe and enforce this limit even if the pool version is < 11 + * so it can be upgraded without issues. */ - if (strlen(pool) >= ZFS_MAX_DATASET_NAME_LEN) { + if (strlen(pool) >= (ZFS_MAX_DATASET_NAME_LEN - 2 - + strlen(ORIGIN_DIR_NAME) * 2)) { if (why) *why = NAME_ERR_TOOLONG; return (-1);
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201711091806.vA9I6ISI011626>