Audit userspace geom code for leaking memory to disk

Any geom class using g_metadata_store, as well as geom_virstor which
duplicated g_metadata_store internally, would dump sectorsize - mdsize bytes
of userspace memory following the metadata block stored. This is most or all
geom classes (gcache, gconcat, geli, gjournal, glabel, gmirror, gmultipath,
graid3, gshsec, gstripe, and geom_virstor).

PR:		222077 (comment #3)
Reported by:	Maxim Khitrov <max AT mxcrypt.com>
Reviewed by:	des
Security:	yes
Sponsored by:	Dell EMC Isilon
Differential Revision:	https://reviews.freebsd.org/D12269

1 files changed, 1 insertions, 0 deletions

diff --git a/sbin/geom/misc/subr.c b/sbin/geom/misc/subr.c
index cf0d9b00cf85..5f5ca9115bc6 100644
--- a/sbin/geom/misc/subr.c
+++ b/sbin/geom/misc/subr.c
@@ -302,6 +302,7 @@ g_metadata_store(const char *name, const unsigned char *md, size_t size)
 		goto out;
 	}
 	bcopy(md, sector, size);
+	bzero(sector + size, sectorsize - size);
 	if (pwrite(fd, sector, sectorsize, mediasize - sectorsize) !=
 	    sectorsize) {
 		error = errno;