Skip to content

nvpair: Check for un-terminated strings in packed nvlist#18604

Merged
behlendorf merged 1 commit into
openzfs:masterfrom
tonyhutter:nvlist-fix
Jun 1, 2026
Merged

nvpair: Check for un-terminated strings in packed nvlist#18604
behlendorf merged 1 commit into
openzfs:masterfrom
tonyhutter:nvlist-fix

Conversation

@tonyhutter
Copy link
Copy Markdown
Contributor

Motivation and Context

Add additional nvlist checks.

Description

Add additional checks to verify a packed string or string array nvpair is terminated. Or more specifically, verify doing a strlen() on the prospective string does not overrun the packed nvlist buffer.

Also add additional checks in the libzfs_input_checks test case to verify un-terminated strings, and add in a nvlist ioctl payload fuzz test for good measure.

How Has This Been Tested?

Test case updated.

Types of changes

  • Bug fix (non-breaking change which fixes an issue)
  • New feature (non-breaking change which adds functionality)
  • Performance enhancement (non-breaking change which improves efficiency)
  • Code cleanup (non-breaking change which makes code smaller or more readable)
  • Quality assurance (non-breaking change which makes the code more robust against bugs)
  • Breaking change (fix or feature that would cause existing functionality to change)
  • Library ABI change (libzfs, libzfs_core, libnvpair, libuutil and libzfsbootenv)
  • Documentation (a change to man pages or other documentation)

Checklist:

@behlendorf behlendorf added the Status: Code Review Needed Ready for review and testing label May 29, 2026
Comment thread tests/zfs-tests/cmd/libzfs_input_check.c
Comment thread module/zfs/zfs_ioctl.c Outdated
Comment thread module/nvpair/nvpair.c Outdated
Add additional checks to verify a packed string or string array nvpair
is terminated.  Or more specifically, verify doing a strlen() on the
prospective string does not overrun the packed nvlist buffer.

Also add additional checks in the libzfs_input_checks test case to
verify un-terminated strings, and add in a nvlist ioctl payload
fuzz test for good measure.

Signed-off-by: Tony Hutter <hutter2@llnl.gov>
@behlendorf behlendorf added Status: Accepted Ready to integrate (reviewed, tested) and removed Status: Code Review Needed Ready for review and testing labels Jun 1, 2026
@behlendorf behlendorf merged commit 59dc886 into openzfs:master Jun 1, 2026
42 of 46 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Status: Accepted Ready to integrate (reviewed, tested)

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants