Date: Tue, 19 Feb 2019 21:33:02 +0000 (UTC) From: Mark Johnston <markj@FreeBSD.org> To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org Subject: svn commit: r344307 - head/sys/geom Message-ID: <201902192133.x1JLX20V017461@repo.freebsd.org>
next in thread | raw e-mail | index | archive | help
Author: markj Date: Tue Feb 19 21:33:02 2019 New Revision: 344307 URL: https://svnweb.freebsd.org/changeset/base/344307 Log: Limit the number of entries allocated for a REPORT_ZONES command. The DIOCGETZONE ioctl can be used to fetch the zone list of an SMR drive, and the caller specifies the number of entries it wants to fetch. Clamp the caller's request to a sane limit so that a user cannot attempt large allocations. Callers already need to invoke the ioctl multiple times to fetch the full list in general, so there's no harm in limiting the number of entries returned. Fix style while here. admbug: 807 Reported by: Ilja Van Sprundel <ivansprundel@ioactive.com> Reviewed by: asomers, ken Tested by: ken MFC after: 1 week Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D19249 Modified: head/sys/geom/geom_dev.c Modified: head/sys/geom/geom_dev.c ============================================================================== --- head/sys/geom/geom_dev.c Tue Feb 19 21:27:30 2019 (r344306) +++ head/sys/geom/geom_dev.c Tue Feb 19 21:33:02 2019 (r344307) @@ -677,8 +677,10 @@ g_dev_ioctl(struct cdev *dev, u_long cmd, caddr_t data alloc_size = 0; if (zone_args->zone_cmd == DISK_ZONE_REPORT_ZONES) { - rep = &zone_args->zone_params.report; +#define MAXENTRIES (MAXPHYS / sizeof(struct disk_zone_rep_entry)) + if (rep->entries_allocated > MAXENTRIES) + rep->entries_allocated = MAXENTRIES; alloc_size = rep->entries_allocated * sizeof(struct disk_zone_rep_entry); if (alloc_size != 0) @@ -688,15 +690,11 @@ g_dev_ioctl(struct cdev *dev, u_long cmd, caddr_t data rep->entries = new_entries; } error = g_io_zonecmd(zone_args, cp); - if ((zone_args->zone_cmd == DISK_ZONE_REPORT_ZONES) - && (alloc_size != 0) - && (error == 0)) { + if (zone_args->zone_cmd == DISK_ZONE_REPORT_ZONES && + alloc_size != 0 && error == 0) error = copyout(new_entries, old_entries, alloc_size); - } - if ((old_entries != NULL) - && (rep != NULL)) + if (old_entries != NULL && rep != NULL) rep->entries = old_entries; - if (new_entries != NULL) g_free(new_entries); break;
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201902192133.x1JLX20V017461>