svn commit: r325605 - vendor-sys/illumos/dist/common/zfs

[Andriy Gapon]

Author: avg
Date: Thu Nov  9 18:06:18 2017
New Revision: 325605
URL: https://svnweb.freebsd.org/changeset/base/325605

Log:
  8713 Buffer overflow in dsl_dataset_name()
  
  illumos/illumos-gate at f37ae9a714b97eca91c74c680c20c750c7cf5c02
  https://github.com/illumos/illumos-gate/commit/f37ae9a714b97eca91c74c680c20c750c7cf5c02
  
  https://www.illumos.org/issues/8713
    If we're creating a pool with version >= SPA_VERSION_DSL_SCRUB (v11) we need to
    account for additional space needed by the origin dataset which will also be
    snapshotted: "poolname"+"/"+"$ORIGIN"+"@"+"$ORIGIN".
    Enforce this limit in pool_namecheck().
  
  Reviewed by: Prakash Surya <prakash.surya at delphix.com>
  Reviewed by: Matthew Ahrens <mahrens at delphix.com>
  Approved by: Dan McDonald <danmcd at joyent.com>
  Author: loli10K <ezomori.nozomu at gmail.com>

Modified:
  vendor-sys/illumos/dist/common/zfs/zfs_namecheck.c

Modified: vendor-sys/illumos/dist/common/zfs/zfs_namecheck.c
==============================================================================
--- vendor-sys/illumos/dist/common/zfs/zfs_namecheck.c	Thu Nov  9 17:58:57 2017	(r325604)
+++ vendor-sys/illumos/dist/common/zfs/zfs_namecheck.c	Thu Nov  9 18:06:18 2017	(r325605)
@@ -44,6 +44,7 @@
 #include <string.h>
 #endif
 
+#include <sys/dsl_dir.h>
 #include <sys/param.h>
 #include <sys/nvpair.h>
 #include "zfs_namecheck.h"
@@ -301,8 +302,14 @@ pool_namecheck(const char *pool, namecheck_err_t *why,
 
 	/*
 	 * Make sure the name is not too long.
+	 * If we're creating a pool with version >= SPA_VERSION_DSL_SCRUB (v11)
+	 * we need to account for additional space needed by the origin ds which
+	 * will also be snapshotted: "poolname"+"/"+"$ORIGIN"+"@"+"$ORIGIN".
+	 * Play it safe and enforce this limit even if the pool version is < 11
+	 * so it can be upgraded without issues.
 	 */
-	if (strlen(pool) >= ZFS_MAX_DATASET_NAME_LEN) {
+	if (strlen(pool) >= (ZFS_MAX_DATASET_NAME_LEN - 2 -
+	    strlen(ORIGIN_DIR_NAME) * 2)) {
 		if (why)
 			*why = NAME_ERR_TOOLONG;
 		return (-1);