From 3d86999c759f720ed14dda8c50de0ad8029f2d23 Mon Sep 17 00:00:00 2001 From: Jason King Date: Tue, 7 Nov 2023 14:11:48 -0600 Subject: [PATCH] sa_lookup() ignores buffer size. When retrieving a system attribute, the size of the supplied buffer is ignored. If the buffer is too small to hold the attribute, sa_attr_op() will write past the end of the buffer. Reviewed-by: Brian Behlendorf Signed-off-by: Jason King Closes #15476 --- module/zfs/sa.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/module/zfs/sa.c b/module/zfs/sa.c index f9daaabbed..0ae4c331dd 100644 --- a/module/zfs/sa.c +++ b/module/zfs/sa.c @@ -23,6 +23,7 @@ * Copyright (c) 2010, Oracle and/or its affiliates. All rights reserved. * Copyright (c) 2013, 2017 by Delphix. All rights reserved. * Copyright (c) 2014 Spectra Logic Corporation, All rights reserved. + * Copyright 2023 RackTop Systems, Inc. */ #include @@ -369,7 +370,7 @@ sa_attr_op(sa_handle_t *hdl, sa_bulk_attr_t *bulk, int count, if (bulk[i].sa_data) { SA_COPY_DATA(bulk[i].sa_data_func, bulk[i].sa_addr, bulk[i].sa_data, - bulk[i].sa_size); + MIN(bulk[i].sa_size, bulk[i].sa_length)); } continue;