diff options
author | mav <mav@FreeBSD.org> | 2016-10-11 16:46:16 +0000 |
---|---|---|
committer | mav <mav@FreeBSD.org> | 2016-10-11 16:46:16 +0000 |
commit | fe6d88ac9b99d21af919d56facd9ed0745db187a (patch) | |
tree | 36f54ce70f3601e04946d696c53d7f6978ae8ed1 /sys/cddl/contrib/opensolaris/uts/common/fs/zfs/spa.c | |
parent | cf06b294a4afda69e928cc38080f53eb6d868c7a (diff) | |
download | FreeBSD-src-fe6d88ac9b99d21af919d56facd9ed0745db187a.zip FreeBSD-src-fe6d88ac9b99d21af919d56facd9ed0745db187a.tar.gz |
MFC r305193: MFV r302642:
6876 Stack corruption after importing a pool with a too-long name
illumos/illumos-gate@c971037baa5d64dfecf6d87ed602fc3116ebec41
https://github.com/illumos/illumos-gate/commit/c971037baa5d64dfecf6d87ed602fc3116ebec41
https://www.illumos.org/issues/6876
Calling dsl_dataset_name on a dataset with a 256 byte buffer is asking for
trouble. We should check every dataset on import, using a 1024 byte buffer and
checking each time to see if the dataset's new name is longer than 256 bytes.
Reviewed by: Prakash Surya <prakash.surya@delphix.com>
Reviewed by: Dan Kimmel <dan.kimmel@delphix.com>
Reviewed by: George Wilson <george.wilson@delphix.com>
Reviewed by: Yuri Pankov <yuri.pankov@nexenta.com>
Approved by: Richard Lowe <richlowe@richlowe.net>
Author: Paul Dagnelie <pcd@delphix.com>
Diffstat (limited to 'sys/cddl/contrib/opensolaris/uts/common/fs/zfs/spa.c')
-rw-r--r-- | sys/cddl/contrib/opensolaris/uts/common/fs/zfs/spa.c | 21 |
1 files changed, 21 insertions, 0 deletions
diff --git a/sys/cddl/contrib/opensolaris/uts/common/fs/zfs/spa.c b/sys/cddl/contrib/opensolaris/uts/common/fs/zfs/spa.c index c31f981..ee2e93b 100644 --- a/sys/cddl/contrib/opensolaris/uts/common/fs/zfs/spa.c +++ b/sys/cddl/contrib/opensolaris/uts/common/fs/zfs/spa.c @@ -1975,6 +1975,19 @@ spa_load_verify_cb(spa_t *spa, zilog_t *zilog, const blkptr_t *bp, return (0); } +/* ARGSUSED */ +int +verify_dataset_name_len(dsl_pool_t *dp, dsl_dataset_t *ds, void *arg) +{ + char namebuf[MAXPATHLEN]; + dsl_dataset_name(ds, namebuf); + if (strlen(namebuf) > MAXNAMELEN) { + return (SET_ERROR(ENAMETOOLONG)); + } + + return (0); +} + static int spa_load_verify(spa_t *spa) { @@ -1989,6 +2002,14 @@ spa_load_verify(spa_t *spa) if (policy.zrp_request & ZPOOL_NEVER_REWIND) return (0); + dsl_pool_config_enter(spa->spa_dsl_pool, FTAG); + error = dmu_objset_find_dp(spa->spa_dsl_pool, + spa->spa_dsl_pool->dp_root_dir_obj, verify_dataset_name_len, NULL, + DS_FIND_CHILDREN); + dsl_pool_config_exit(spa->spa_dsl_pool, FTAG); + if (error != 0) + return (error); + rio = zio_root(spa, NULL, &sle, ZIO_FLAG_CANFAIL | ZIO_FLAG_SPECULATIVE); |