{"action":"created","issue":{"url":"https://api.github.com/repos/zfsonlinux/zfs/issues/4152","labels_url":"https://api.github.com/repos/zfsonlinux/zfs/issues/4152/labels{/name}","comments_url":"https://api.github.com/repos/zfsonlinux/zfs/issues/4152/comments","events_url":"https://api.github.com/repos/zfsonlinux/zfs/issues/4152/events","html_url":"https://github.com/zfsonlinux/zfs/pull/4152","id":124298337,"number":4152,"title":"Prevent SA length overflow","user":{"login":"nedbass","id":320381,"avatar_url":"https://avatars.githubusercontent.com/u/320381?v=3","gravatar_id":"","url":"https://api.github.com/users/nedbass","html_url":"https://github.com/nedbass","followers_url":"https://api.github.com/users/nedbass/followers","following_url":"https://api.github.com/users/nedbass/following{/other_user}","gists_url":"https://api.github.com/users/nedbass/gists{/gist_id}","starred_url":"https://api.github.com/users/nedbass/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/nedbass/subscriptions","organizations_url":"https://api.github.com/users/nedbass/orgs","repos_url":"https://api.github.com/users/nedbass/repos","events_url":"https://api.github.com/users/nedbass/events{/privacy}","received_events_url":"https://api.github.com/users/nedbass/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":3,"created_at":"2015-12-30T03:10:55Z","updated_at":"2015-12-30T20:42:07Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/zfsonlinux/zfs/pulls/4152","html_url":"https://github.com/zfsonlinux/zfs/pull/4152","diff_url":"https://github.com/zfsonlinux/zfs/pull/4152.diff","patch_url":"https://github.com/zfsonlinux/zfs/pull/4152.patch"},"body":"The function sa_update() accepts a 32-bit length parameter and\r\nassigns it to a 16-bit field in sa_bulk_attr_t, potentially\r\ntruncating the passed-in value. This could lead to corrupt system\r\nattribute (SA) records getting written to disk. Add a VERIFY to\r\nsa_update() to detect cases where overflow would occur. The SA length\r\nis limited to 16-bit values by the on-disk format defined by\r\nsa_hdr_phys_t.\r\n\r\nThe function zfs_sa_set_xattr() is vulnerable to this bug if the\r\nunpacked nvlist of xattrs is less than 64k in size but the packed\r\nsize is greater than 64k. Fix this by appropriately checking the\r\nsize of the packed nvlist before calling sa_update(). Add error\r\nhandling to zpl_xattr_set_sa() to keep the cached list of SA-based\r\nxattrs consistent with the data on-disk.\r\n\r\nLastly, zfs_sa_set_xattr() calls dmu_tx_abort() on an assigned\r\ntransaction if sa_update() returns an error, but the DMU only allows\r\nunassigned transactions to be aborted. Wrap the sa_update() call in a\r\nVERIFY0, which is consistent practice with other callers.\r\n\r\nFixes #4150\r\n\r\nSigned-off-by: Ned Bass <bass6@llnl.gov>"},"comment":{"url":"https://api.github.com/repos/zfsonlinux/zfs/issues/comments/168070388","html_url":"https://github.com/zfsonlinux/zfs/pull/4152#issuecomment-168070388","issue_url":"https://api.github.com/repos/zfsonlinux/zfs/issues/4152","id":168070388,"user":{"login":"ryao","id":1386373,"avatar_url":"https://avatars.githubusercontent.com/u/1386373?v=3","gravatar_id":"","url":"https://api.github.com/users/ryao","html_url":"https://github.com/ryao","followers_url":"https://api.github.com/users/ryao/followers","following_url":"https://api.github.com/users/ryao/following{/other_user}","gists_url":"https://api.github.com/users/ryao/gists{/gist_id}","starred_url":"https://api.github.com/users/ryao/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ryao/subscriptions","organizations_url":"https://api.github.com/users/ryao/orgs","repos_url":"https://api.github.com/users/ryao/repos","events_url":"https://api.github.com/users/ryao/events{/privacy}","received_events_url":"https://api.github.com/users/ryao/received_events","type":"User","site_admin":false},"created_at":"2015-12-30T20:42:07Z","updated_at":"2015-12-30T20:42:07Z","body":"@nedbass This looks good to me."}}