Page MenuHomeFreeBSD

ufs: Avoid subobject overflow in snapshot expunge code
ClosedPublic

Authored by jrtc27 on Dec 24 2021, 4:08 PM.
Tags
None
Referenced Files
Unknown Object (File)
Sun, Nov 10, 1:32 AM
Unknown Object (File)
Sat, Nov 9, 10:57 PM
Unknown Object (File)
Sat, Nov 9, 5:59 PM
Unknown Object (File)
Fri, Nov 1, 5:44 PM
Unknown Object (File)
Fri, Oct 25, 8:55 AM
Unknown Object (File)
Sat, Oct 19, 10:16 AM
Unknown Object (File)
Oct 7 2024, 3:20 PM
Unknown Object (File)
Oct 4 2024, 3:42 PM
Subscribers

Details

Summary

The code here tries to be smart and zeroes out both di_db and di_ib with
a single bzero call, thereby overrunning the di_db subobject. This is
fine on most architectures, if a little dodgy. However, on CHERI, the
compiler can optionally restrict the bounds on pointers to subobjects to
just that subobject, in order to mitigate intra-object buffer overflows,
and this is enabled in CheriBSD's pure-capability kernels.

Instead, use separate bzero calls for each array, and let the compiler
optimise it as it sees fit; even if it's not generating inline zeroing
code, Clang will happily optimise two consecutive bzero's to a single
larger call.

Diff Detail

Repository
rG FreeBSD src repository
Lint
Lint Not Applicable
Unit
Tests Not Applicable