diff options
author | allanjude <allanjude@FreeBSD.org> | 2016-10-08 00:01:07 +0000 |
---|---|---|
committer | allanjude <allanjude@FreeBSD.org> | 2016-10-08 00:01:07 +0000 |
commit | d5fb643e49c8ff43324d3b81d16557a0b8bc984f (patch) | |
tree | 58b115b466e5ba562dcb39ca42ac7f1240a2f4e6 | |
parent | 8635e98fdcc3c34e69a11e19456a4993a172acdc (diff) | |
download | FreeBSD-src-d5fb643e49c8ff43324d3b81d16557a0b8bc984f.zip FreeBSD-src-d5fb643e49c8ff43324d3b81d16557a0b8bc984f.tar.gz |
MFC: r306677
GELIBoot may attempt to read past the end of the disk
PR: 213196
Relnotes: yes
Sponsored by: ScaleEngine Inc.
-rw-r--r-- | sys/boot/geli/geliboot.c | 20 |
1 files changed, 14 insertions, 6 deletions
diff --git a/sys/boot/geli/geliboot.c b/sys/boot/geli/geliboot.c index 10df707..f9a128c 100644 --- a/sys/boot/geli/geliboot.c +++ b/sys/boot/geli/geliboot.c @@ -77,17 +77,25 @@ geli_taste(int read_func(void *vdev, void *priv, off_t off, void *buf, int error; off_t alignsector; - alignsector = (lastsector * DEV_BSIZE) & - ~(off_t)(DEV_GELIBOOT_BSIZE - 1); + alignsector = rounddown2(lastsector * DEV_BSIZE, DEV_GELIBOOT_BSIZE); + if (alignsector + DEV_GELIBOOT_BSIZE > ((lastsector + 1) * DEV_BSIZE)) { + /* Don't read past the end of the disk */ + alignsector = (lastsector * DEV_BSIZE) + DEV_BSIZE + - DEV_GELIBOOT_BSIZE; + } error = read_func(NULL, dskp, alignsector, &buf, DEV_GELIBOOT_BSIZE); if (error != 0) { return (error); } - /* Extract the last DEV_BSIZE bytes from the block. */ - error = eli_metadata_decode(buf + (DEV_GELIBOOT_BSIZE - DEV_BSIZE), - &md); + /* Extract the last 4k sector of the disk. */ + error = eli_metadata_decode(buf, &md); if (error != 0) { - return (error); + /* Try the last 512 byte sector instead. */ + error = eli_metadata_decode(buf + + (DEV_GELIBOOT_BSIZE - DEV_BSIZE), &md); + if (error != 0) { + return (error); + } } if (!(md.md_flags & G_ELI_FLAG_GELIBOOT)) { |