From d9fca828bfdadcb197f3d8b126d6ab5eb90307dd Mon Sep 17 00:00:00 2001 From: asomers Date: Sat, 10 Mar 2018 04:17:01 +0000 Subject: [PATCH] MFC r323314, r323338, r328849 r323314: Audit userspace geom code for leaking memory to disk Any geom class using g_metadata_store, as well as geom_virstor which duplicated g_metadata_store internally, would dump sectorsize - mdsize bytes of userspace memory following the metadata block stored. This is most or all geom classes (gcache, gconcat, geli, gjournal, glabel, gmirror, gmultipath, graid3, gshsec, gstripe, and geom_virstor). PR: 222077 (comment #3) Reported by: Maxim Khitrov Reviewed by: des Security: yes Sponsored by: Dell EMC Isilon Differential Revision: https://reviews.freebsd.org/D12269 r323338: Fix information leak in geli(8) integrity mode In integrity mode, a larger logical sector (e.g., 4096 bytes) spans several physical sectors (e.g., 512 bytes) on the backing device. Due to hash overhead, a 4096 byte logical sector takes 8.5625 512-byte physical sectors. This means that only 288 bytes (256 data + 32 hash) of the last 512 byte sector are used. The memory allocation used to store the encrypted data to be written to the physical sectors comes from malloc(9) and does not use M_ZERO. Previously, nothing initialized the final physical sector backing each logical sector, aside from the hash + encrypted data portion. So 224 bytes of kernel heap memory was leaked to every block :-(. This patch addresses the issue by initializing the trailing portion of the physical sector in every logical sector to zeros before use. A much simpler but higher overhead fix would be to tag the entire allocation M_ZERO. PR: 222077 Reported by: Maxim Khitrov Reviewed by: emaste Security: yes Sponsored by: Dell EMC Isilon Differential Revision: https://reviews.freebsd.org/D12272 r328849: geom: don't write stack garbage in disk labels Most consumers of g_metadata_store were passing in partially unallocated memory, resulting in stack garbage being written to disk labels. Fix them by zeroing the memory first. gvirstor repeated the same mistake, but in the kernel. Also, glabel's label contained a fixed-size string that wasn't initialized to zero. PR: 222077 Reported by: Maxim Khitrov Reviewed by: cem X-MFC-With: 323314 X-MFC-With: 323338 Differential Revision: https://reviews.freebsd.org/D14164 git-svn-id: svn://svn.freebsd.org/base/stable/10@330737 ccf9f872-aa2e-dd11-9fc8-001c23d0bc1f --- sbin/geom/class/cache/geom_cache.c | 1 + sbin/geom/class/concat/geom_concat.c | 1 + sbin/geom/class/journal/geom_journal.c | 1 + sbin/geom/class/label/geom_label.c | 2 ++ sbin/geom/class/mirror/geom_mirror.c | 1 + sbin/geom/class/raid3/geom_raid3.c | 1 + sbin/geom/class/shsec/geom_shsec.c | 1 + sbin/geom/class/stripe/geom_stripe.c | 1 + sbin/geom/class/virstor/geom_virstor.c | 1 + sbin/geom/misc/subr.c | 8 ++++++++ sys/geom/eli/g_eli_integrity.c | 10 +++++++++- sys/geom/virstor/g_virstor.c | 1 + 12 files changed, 28 insertions(+), 1 deletion(-) diff --git a/sbin/geom/class/cache/geom_cache.c b/sbin/geom/class/cache/geom_cache.c index 4b18e67dd..0d3001d65 100644 --- a/sbin/geom/class/cache/geom_cache.c +++ b/sbin/geom/class/cache/geom_cache.c @@ -135,6 +135,7 @@ cache_label(struct gctl_req *req) int error, nargs; intmax_t val; + bzero(sector, sizeof(sector)); nargs = gctl_get_int(req, "nargs"); if (nargs != 2) { gctl_error(req, "Invalid number of arguments."); diff --git a/sbin/geom/class/concat/geom_concat.c b/sbin/geom/class/concat/geom_concat.c index d4f3645f3..847e264c6 100644 --- a/sbin/geom/class/concat/geom_concat.c +++ b/sbin/geom/class/concat/geom_concat.c @@ -117,6 +117,7 @@ concat_label(struct gctl_req *req) const char *name; int error, i, hardcode, nargs; + bzero(sector, sizeof(sector)); nargs = gctl_get_int(req, "nargs"); if (nargs < 2) { gctl_error(req, "Too few arguments."); diff --git a/sbin/geom/class/journal/geom_journal.c b/sbin/geom/class/journal/geom_journal.c index 681ff4794..11e843731 100644 --- a/sbin/geom/class/journal/geom_journal.c +++ b/sbin/geom/class/journal/geom_journal.c @@ -142,6 +142,7 @@ journal_label(struct gctl_req *req) intmax_t jsize, msize, ssize; int error, force, i, nargs, checksum, hardcode; + bzero(sector, sizeof(sector)); nargs = gctl_get_int(req, "nargs"); str = NULL; /* gcc */ diff --git a/sbin/geom/class/label/geom_label.c b/sbin/geom/class/label/geom_label.c index 6c880eebe..9b26925e5 100644 --- a/sbin/geom/class/label/geom_label.c +++ b/sbin/geom/class/label/geom_label.c @@ -117,6 +117,7 @@ label_label(struct gctl_req *req) u_char sector[512]; int error, nargs; + bzero(sector, sizeof(sector)); nargs = gctl_get_int(req, "nargs"); if (nargs != 2) { gctl_error(req, "Invalid number of arguments."); @@ -137,6 +138,7 @@ label_label(struct gctl_req *req) strlcpy(md.md_magic, G_LABEL_MAGIC, sizeof(md.md_magic)); md.md_version = G_LABEL_VERSION; label = gctl_get_ascii(req, "arg0"); + bzero(md.md_label, sizeof(md.md_label)); strlcpy(md.md_label, label, sizeof(md.md_label)); md.md_provsize = g_get_mediasize(name); if (md.md_provsize == 0) { diff --git a/sbin/geom/class/mirror/geom_mirror.c b/sbin/geom/class/mirror/geom_mirror.c index 30f5f8494..44e15f4a8 100644 --- a/sbin/geom/class/mirror/geom_mirror.c +++ b/sbin/geom/class/mirror/geom_mirror.c @@ -176,6 +176,7 @@ mirror_label(struct gctl_req *req) intmax_t val; int error, i, nargs, bal, hardcode; + bzero(sector, sizeof(sector)); nargs = gctl_get_int(req, "nargs"); if (nargs < 2) { gctl_error(req, "Too few arguments."); diff --git a/sbin/geom/class/raid3/geom_raid3.c b/sbin/geom/class/raid3/geom_raid3.c index cd0aa65b1..e60911b06 100644 --- a/sbin/geom/class/raid3/geom_raid3.c +++ b/sbin/geom/class/raid3/geom_raid3.c @@ -149,6 +149,7 @@ raid3_label(struct gctl_req *req) int hardcode, round_robin, verify; int error, i, nargs; + bzero(sector, sizeof(sector)); nargs = gctl_get_int(req, "nargs"); if (nargs < 4) { gctl_error(req, "Too few arguments."); diff --git a/sbin/geom/class/shsec/geom_shsec.c b/sbin/geom/class/shsec/geom_shsec.c index a5d1b6617..7c5db2108 100644 --- a/sbin/geom/class/shsec/geom_shsec.c +++ b/sbin/geom/class/shsec/geom_shsec.c @@ -110,6 +110,7 @@ shsec_label(struct gctl_req *req) const char *name; int error, i, nargs, hardcode; + bzero(sector, sizeof(sector)); nargs = gctl_get_int(req, "nargs"); if (nargs <= 2) { gctl_error(req, "Too few arguments."); diff --git a/sbin/geom/class/stripe/geom_stripe.c b/sbin/geom/class/stripe/geom_stripe.c index 2e9e3db13..fc8e47606 100644 --- a/sbin/geom/class/stripe/geom_stripe.c +++ b/sbin/geom/class/stripe/geom_stripe.c @@ -128,6 +128,7 @@ stripe_label(struct gctl_req *req) const char *name; int error, i, nargs, hardcode; + bzero(sector, sizeof(sector)); nargs = gctl_get_int(req, "nargs"); if (nargs < 3) { gctl_error(req, "Too few arguments."); diff --git a/sbin/geom/class/virstor/geom_virstor.c b/sbin/geom/class/virstor/geom_virstor.c index 15a56761d..1fe4ea62b 100644 --- a/sbin/geom/class/virstor/geom_virstor.c +++ b/sbin/geom/class/virstor/geom_virstor.c @@ -183,6 +183,7 @@ my_g_metadata_store(const char *name, u_char *md, size_t size) goto out; } bcopy(md, sector, size); + bzero(sector + size, sectorsize - size); if (pwrite(fd, sector, sectorsize, mediasize - sectorsize) != (ssize_t)sectorsize) { error = errno; diff --git a/sbin/geom/misc/subr.c b/sbin/geom/misc/subr.c index cf0d9b00c..207b9ba88 100644 --- a/sbin/geom/misc/subr.c +++ b/sbin/geom/misc/subr.c @@ -271,6 +271,13 @@ g_metadata_read(const char *name, unsigned char *md, size_t size, return (error); } +/* + * Actually write the GEOM label to the provider + * + * @param name GEOM provider's name (ie "ada0") + * @param md Pointer to the label data to write + * @param size Size of the data pointed to by md + */ int g_metadata_store(const char *name, const unsigned char *md, size_t size) { @@ -302,6 +309,7 @@ g_metadata_store(const char *name, const unsigned char *md, size_t size) goto out; } bcopy(md, sector, size); + bzero(sector + size, sectorsize - size); if (pwrite(fd, sector, sectorsize, mediasize - sectorsize) != sectorsize) { error = errno; diff --git a/sys/geom/eli/g_eli_integrity.c b/sys/geom/eli/g_eli_integrity.c index aeb5c2a41..6db68d587 100644 --- a/sys/geom/eli/g_eli_integrity.c +++ b/sys/geom/eli/g_eli_integrity.c @@ -468,8 +468,16 @@ g_eli_auth_run(struct g_eli_worker *wr, struct bio *bp) iov = (struct iovec *)p; p += sizeof(*iov); data_secsize = sc->sc_data_per_sector; - if ((i % lsec) == 0) + if ((i % lsec) == 0) { data_secsize = decr_secsize % data_secsize; + /* + * Last encrypted sector of each decrypted sector is + * only partially filled. + */ + if (bp->bio_cmd == BIO_WRITE) + memset(data + sc->sc_alen + data_secsize, 0, + encr_secsize - sc->sc_alen - data_secsize); + } if (bp->bio_cmd == BIO_READ) { /* Remember read HMAC. */ diff --git a/sys/geom/virstor/g_virstor.c b/sys/geom/virstor/g_virstor.c index fb53a2fab..5732fd30c 100644 --- a/sys/geom/virstor/g_virstor.c +++ b/sys/geom/virstor/g_virstor.c @@ -1044,6 +1044,7 @@ write_metadata(struct g_consumer *cp, struct g_virstor_metadata *md) pp = cp->provider; buf = malloc(pp->sectorsize, M_GVIRSTOR, M_WAITOK); + bzero(buf, pp->sectorsize); virstor_metadata_encode(md, buf); g_topology_unlock(); error = g_write_data(cp, pp->mediasize - pp->sectorsize, buf, -- 2.45.0