path: root/stand/libsa/ufs.c
diff options
authorJessica Clarke <jrtc27@FreeBSD.org>2022-01-02 20:55:36 +0000
committerJessica Clarke <jrtc27@FreeBSD.org>2022-01-02 20:55:36 +0000
commit5b13fa7987c13aa7b5a67cc6b465475912de2d14 (patch)
tree0b92d95488bae37aa8703134a1b6696ba9e041cf /stand/libsa/ufs.c
parent04fd468da0d0baea535da418b92df74101a9659d (diff)
ufs: Rework shortlink handling to avoid subobject overflows
Shortlinks occupy the space of both di_db and di_ib when used. However, everywhere that wants to read or write a shortlink takes a pointer do di_db and promptly runs off the end of it into di_ib. This is fine on most architectures, if a little dodgy. However, on CHERI, the compiler can optionally restrict the bounds on pointers to subobjects to just that subobject, in order to mitigate intra-object buffer overflows, and this is enabled in CheriBSD's pure-capability kernels. Instead, clean this up by inserting a union such that a new di_shortlink can be added with the right size and element type, avoiding the need to cast and allowing the use of the DIP macro to access the field. This also mirrors how the ext2fs code implements extents support, with the exact same structure other than having a uint32_t i_data[] instead of a char di_shortlink[]. Reviewed by: mckusick, jhb Differential Revision: https://reviews.freebsd.org/D33650
Diffstat (limited to 'stand/libsa/ufs.c')
1 files changed, 2 insertions, 5 deletions
diff --git a/stand/libsa/ufs.c b/stand/libsa/ufs.c
index 31212bf3473a..12703a3e18aa 100644
--- a/stand/libsa/ufs.c
+++ b/stand/libsa/ufs.c
@@ -638,11 +638,8 @@ ufs_open(const char *upath, struct open_file *f)
bcopy(cp, &namebuf[link_len], len + 1);
if (link_len < fs->fs_maxsymlinklen) {
- if (fp->f_fs->fs_magic == FS_UFS1_MAGIC)
- cp = (caddr_t)(fp->f_di.di1.di_db);
- else
- cp = (caddr_t)(fp->f_di.di2.di_db);
- bcopy(cp, namebuf, (unsigned) link_len);
+ bcopy(DIP(fp, di_shortlink), namebuf,
+ (unsigned) link_len);
} else {
* Read file for symbolic link