libzfs: str2shift called with NULL handle can crash
> ::status debugging core file of zpool (64-bit) from openindiana file: /sbin/zpool initial argv: zpool trim -r 10X testpool threading model: native threads status: process terminated by SIGSEGV (Segmentation Fault), addr=43c > ::stack libc.so.1`memcpy+0x58c() libc.so.1`_ndoprnt+0x2d0(7fffaefb80f6, 7fffbfffa700, 7fffbfffa650, 0) libc.so.1`vsnprintf+0x79(43c, 400, 7fffaefb80f6, 7fffbfffa700) libzfs.so.1`zfs_error_aux+0xb5(0, 7fffaefb80f6) libzfs.so.1`str2shift+0xf3(0, 7fffbfffef50) libzfs.so.1`zfs_nicestrtonum+0xd1(0, 7fffbfffef4e, 7fffbfffa8e8) zpool_do_trim+0xf6(4, 7fffbfffeab0) main+0xdf(5, 7fffbfffeaa8) _start_crt+0x87() _start+0x18() > 7fffbfffef4e/S 0x7fffbfffef4e: 10XX is illegal in str2shift(), and we will call zfs_error_aux() without
checking if hdl is NULL or not.
Testing done: verified command: "zpool trim -r 10X poolname" does not crash, but will print error message instead:
tsoome@beastie:/code/14153$ env LD_LIBRARY_PATH=/code/14153/proto/root_i386/usr/lib/amd64 zpool trim -r 10X rpool invalid value for rate usage: trim [-d] [-r <rate>] [-c | -s] <pool> [<device> ...]
Updated by Andy Fiddaman 14 days ago
See also https://github.com/openzfs/zfs/commit/53c2ec1d1b3ffdc90c1c6516558e6b4da77c2446
which is the fix that went into OpenZFS.
Updated by Toomas Soome 14 days ago
Yuri Pankov wrote in #note-3:
With both openzfs and proposed fixes we are missing the error message, wonder if we can open/close temporary hdl if we were passed a NULL one.
That is another issue (with zpool command, not with libzfs). Worth fixing, I think, but still another issue.
Updated by Electric Monk 8 days ago
- Status changed from In Progress to Closed
- % Done changed from 90 to 100
commit 9e494b8a787c7b2d9fd087a2dde8811e386513d4 Author: Toomas Soome <firstname.lastname@example.org> Date: 2021-10-15T22:15:40.000Z 14153 libzfs: str2shift called with NULL handle can crash Reviewed by: Andy Fiddaman <email@example.com> Reviewed by: Yuri Pankov <firstname.lastname@example.org> Approved by: Robert Mustacchi <email@example.com>