From owner-svn-src-head@FreeBSD.ORG  Fri Nov  5 22:18:10 2010
Return-Path: <owner-svn-src-head@FreeBSD.ORG>
Delivered-To: svn-src-head@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34])
	by hub.freebsd.org (Postfix) with ESMTP id 071EE1065672;
	Fri,  5 Nov 2010 22:18:10 +0000 (UTC)
	(envelope-from delphij@FreeBSD.org)
Received: from svn.freebsd.org (svn.freebsd.org [IPv6:2001:4f8:fff6::2c])
	by mx1.freebsd.org (Postfix) with ESMTP id E95298FC18;
	Fri,  5 Nov 2010 22:18:09 +0000 (UTC)
Received: from svn.freebsd.org (localhost [127.0.0.1])
	by svn.freebsd.org (8.14.3/8.14.3) with ESMTP id oA5MI9vX010849;
	Fri, 5 Nov 2010 22:18:09 GMT (envelope-from delphij@svn.freebsd.org)
Received: (from delphij@localhost)
	by svn.freebsd.org (8.14.3/8.14.3/Submit) id oA5MI9MR010847;
	Fri, 5 Nov 2010 22:18:09 GMT (envelope-from delphij@svn.freebsd.org)
Message-Id: <201011052218.oA5MI9MR010847@svn.freebsd.org>
From: Xin LI <delphij@FreeBSD.org>
Date: Fri, 5 Nov 2010 22:18:09 +0000 (UTC)
To: src-committers@freebsd.org, svn-src-all@freebsd.org,
	svn-src-head@freebsd.org
X-SVN-Group: head
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Cc: 
Subject: svn commit: r214854 -
	head/sys/cddl/contrib/opensolaris/uts/common/fs/zfs
X-BeenThere: svn-src-head@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: SVN commit messages for the src tree for head/-current
	<svn-src-head.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/svn-src-head>,
	<mailto:svn-src-head-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/svn-src-head>
List-Post: <mailto:svn-src-head@freebsd.org>
List-Help: <mailto:svn-src-head-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/svn-src-head>,
	<mailto:svn-src-head-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Fri, 05 Nov 2010 22:18:10 -0000

Author: delphij
Date: Fri Nov  5 22:18:09 2010
New Revision: 214854
URL: http://svn.freebsd.org/changeset/base/214854

Log:
  Validate whether the zfs_cmd_t submitted from userland is not smaller than
  what we have.  Without the check the kernel could accessing memory that
  does not belong to the request struct.
  
  Note that we do not test if the struct equals in size at this time, which
  may faciliate forward compatibility with newer binaries.
  
  Reviewed by:	pjd at MeetBSD CA '2010
  MFC after:	1 week

Modified:
  head/sys/cddl/contrib/opensolaris/uts/common/fs/zfs/zfs_ioctl.c

Modified: head/sys/cddl/contrib/opensolaris/uts/common/fs/zfs/zfs_ioctl.c
==============================================================================
--- head/sys/cddl/contrib/opensolaris/uts/common/fs/zfs/zfs_ioctl.c	Fri Nov  5 21:47:58 2010	(r214853)
+++ head/sys/cddl/contrib/opensolaris/uts/common/fs/zfs/zfs_ioctl.c	Fri Nov  5 22:18:09 2010	(r214854)
@@ -3627,6 +3627,14 @@ zfsdev_ioctl(struct cdev *dev, u_long cm
 	uint_t vec;
 	int error;
 
+	/*
+	 * Check if we have sufficient kernel memory allocated
+	 * for the zfs_cmd_t request.  Bail out if not so we
+	 * will not access undefined memory region.
+	 */
+	if (IOCPARM_LEN(cmd) < sizeof(zfs_cmd_t))
+		return (EINVAL);
+
 	vec = ZFS_IOC(cmd);
 
 	if (vec >= sizeof (zfs_ioc_vec) / sizeof (zfs_ioc_vec[0]))