HomeFreeBSD

OpenZFS 7263 - deeply nested nvlist can overflow stack

Description

OpenZFS 7263 - deeply nested nvlist can overflow stack

nvlist_pack() and nvlist_unpack are implemented recursively, which can
cause the stack to overflow with a deeply nested nvlist; i.e. an nvlist
which contains an nvlist, which contains an nvlist, which...

Unprivileged users can pass an nvlist to the kernel via certain ioctls
on /dev/zfs, which the kernel will unpack without additional permission
checking or validation. Therefore, an unprivileged user can cause the
kernel's stack to overflow and panic.

Ideally, these functions would be implemented non-recursively. As a
quick fix, this patch limits the depth of the recursion and returns an
error when attempting to pack and unpack a deeply-nested nvlist.

Signed-off-by: Adam Leventhal <ahl@delphix.com>
Signed-off-by: George Wilson <george.wilson@delphix.com>
Signed-off-by: Brian Behlendorf <behlendorf1@llnl.gov>
Ported-by: Prakash Surya <prakash.surya@delphix.com>

OpenZFS-issue: https://www.illumos.org/issues/7263
OpenZFS-commit: https://github.com/openzfs/openzfs/commit/0511d6d

Details

Provenance
mahrensAuthored on Jan 13 2016, 6:45 PM
Brian Behlendorf <behlendorf1@llnl.gov>Committed on Aug 11 2016, 10:58 PM
Parents
rGb320dd91a926: Fix infinite loop when zdb -R with d flag
Branches
Unknown
Tags
Unknown