mirror of
https://github.com/freebsd/freebsd-src.git
synced 2026-11-07 04:36:52 -10:00
Josh Megnauth
1a4c2eedad
`ISO_RRIP_ANALYZE` is constructed in four places. Two of the initializers set the `outlen` field while the other two, `cd9660_rrip_analyze` and `cd9660_rrip_offset`, leave it uninitialized. The uninitialized paths can dereference an invalid pointer on error paths which causes a kernel panic. To fix, I zero out `ISO_RRIP_ANALYZE` in all four places where it's initialized and check that `outlen` is non-null on the error path in `cd9660_rrip_loop`. While testing the above, I encountered another kernel panic due to mounting continuing after the error branch. Evidently, the ISO continued mounting through the normal ISO 9660 path then triggered a panic down the line due to a very broken file system from the ISO. To fix that, I propagate the error from the RR path then fail in the mount path. A previous iteration of this commit included the ISO from the PR. The current iteration creates an ISO with makefs then corrupts it with a small helper written in C that is a condensed version of the CD 9660 code. It checks the input ISO for a a Rock Ridge extension reference then corrupts the length byte. This triggers the early failure in cd9660_rrip_offset. PR: https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=296853 Signed-off-by: Josh Megnauth <[email protected]> Reviewed-by: ngie Pull-Request: https://github.com/freebsd/freebsd-src/pull/2462