diff options
author | delphij <delphij@FreeBSD.org> | 2011-10-17 22:23:27 +0000 |
---|---|---|
committer | delphij <delphij@FreeBSD.org> | 2011-10-17 22:23:27 +0000 |
commit | 34ca38d01dfe44d824941d382c587ea8df3ec737 (patch) | |
tree | 4da38dfbcc9a1f61d9c314b8abafd0f4890d0d92 /sys/cddl/contrib/opensolaris/uts/common/fs/zfs/sa.c | |
parent | 6184b463fa93bf224cbd6c7f67852ba5e1df64d1 (diff) | |
download | FreeBSD-src-34ca38d01dfe44d824941d382c587ea8df3ec737.zip FreeBSD-src-34ca38d01dfe44d824941d382c587ea8df3ec737.tar.gz |
Fix a bug in sa_find_sizes() which could lead to panic:
When calculating space needed for SA_BONUS buffers,
hdrsize is always rounded up to next 8-aligned boundary.
However, in two places the round up was done against
sum of 'total' plus hdrsize. On the other hand,
hdrsize increments by 4 each time, which means in
certain conditions, we would end up returning with
will_spill == 0 and (total + hdrsize) larger than
full_space, leading to a failed assertion because
it's invalid for dmu_set_bonus.
Sponsored by: iXsystems, Inc.
Reviewed by: mm
MFC after: 3 days
Diffstat (limited to 'sys/cddl/contrib/opensolaris/uts/common/fs/zfs/sa.c')
-rw-r--r-- | sys/cddl/contrib/opensolaris/uts/common/fs/zfs/sa.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/sys/cddl/contrib/opensolaris/uts/common/fs/zfs/sa.c b/sys/cddl/contrib/opensolaris/uts/common/fs/zfs/sa.c index 4db13fd..116658d 100644 --- a/sys/cddl/contrib/opensolaris/uts/common/fs/zfs/sa.c +++ b/sys/cddl/contrib/opensolaris/uts/common/fs/zfs/sa.c @@ -605,14 +605,14 @@ sa_find_sizes(sa_os_t *sa, sa_bulk_attr_t *attr_desc, int attr_count, * and spill buffer. */ if (buftype == SA_BONUS && *index == -1 && - P2ROUNDUP(*total + hdrsize, 8) > + (*total + P2ROUNDUP(hdrsize, 8)) > (full_space - sizeof (blkptr_t))) { *index = i; done = B_TRUE; } next: - if (P2ROUNDUP(*total + hdrsize, 8) > full_space && + if ((*total + P2ROUNDUP(hdrsize, 8)) > full_space && buftype == SA_BONUS) *will_spill = B_TRUE; } |