Fix zfs_ioc_pool_sync should not use fnvlist

Use fnvlist on user input would allow user to easily panic zfs.

Reviewed-by: Brian Behlendorf <behlendorf1@llnl.gov>
Reviewed-by: Giuseppe Di Natale <dinatale2@llnl.gov>
Reviewed-by: Alek Pinchuk <apinchuk@datto.com>
Signed-off-by: Chunwei Chen <david.chen@osnexus.com>
Closes #6529

diff --git a/module/zfs/zfs_ioctl.c b/module/zfs/zfs_ioctl.c
index 9f32d00ac27b82226cc022754fc9d2b6f5d5e38d..b51b3b79c40ec8325cb6d90dbc4e6e7c9c0e8d28 100644 (file)
--- a/module/zfs/zfs_ioctl.c
+++ b/module/zfs/zfs_ioctl.c
@@ -5983,20 +5983,26 @@ static int
 zfs_ioc_pool_sync(const char *pool, nvlist_t *innvl, nvlist_t *onvl)
 {
        int err;
-       boolean_t force;
+       boolean_t force = B_FALSE;
        spa_t *spa;
 
        if ((err = spa_open(pool, &spa, FTAG)) != 0)
                return (err);
 
-       force = fnvlist_lookup_boolean_value(innvl, "force");
+       if (innvl) {
+               if (nvlist_lookup_boolean_value(innvl, "force", &force) != 0) {
+                       err = SET_ERROR(EINVAL);
+                       goto out;
+               }
+       }
+
        if (force) {
                spa_config_enter(spa, SCL_CONFIG, FTAG, RW_WRITER);
                vdev_config_dirty(spa->spa_root_vdev);
                spa_config_exit(spa, SCL_CONFIG, FTAG);
        }
        txg_wait_synced(spa_get_dsl(spa), 0);
-
+out:
        spa_close(spa, FTAG);
 
        return (err);