Date: Sat, 29 Aug 2015 03:03:23 -0700 From: Xin Li <delphij@delphij.net> To: FreeBSD Current <freebsd-current@FreeBSD.org> Subject: HEADSUP: Memory corruption issue with ZFS users using L2ARC [Fwd: svn commit: r287283 - head/sys/cddl/contrib/opensolaris/uts/common/fs/zfs] Message-ID: <55E1836B.6040107@delphij.net> In-Reply-To: <201508290922.t7T9MXhF007620@repo.freebsd.org> References: <201508290922.t7T9MXhF007620@repo.freebsd.org>
next in thread | previous in thread | raw e-mail | index | archive | help
This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --a1Mj4oE6IBTRJNqvgx1CnCTDId9wr8DJe Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Hi, Please note that -CURRENT in revision range of [r286951, 287283), approximately 9 days ago until now, are affected by a buffer overrun issue that may cause data corruption (!) which may manifest itself as random panics that relates to NULL pointer deference (e.g. Kernel Trap 12 with <4K fault address), or strange UMA related panics. Systems that do not have L2ARC devices are not affected by this problem. The affected code is L2ARC specific. For those who are using L2ARC devices -- it's not clear to me how bad the corruption could affect the on disk data for ZFS. If you are running -CURRENT and have L2ARC, please be sure to examine if you have any data loss. Cheers, -------- Forwarded Message -------- Subject: svn commit: r287283 - head/sys/cddl/contrib/opensolaris/uts/common/fs/zfs Date: Sat, 29 Aug 2015 09:22:33 +0000 (UTC) From: Xin LI <delphij@FreeBSD.org> To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org Author: delphij Date: Sat Aug 29 09:22:32 2015 New Revision: 287283 URL: https://svnweb.freebsd.org/changeset/base/287283 Log: Fix a buffer overrun which may lead to data corruption, introduced in r286951 by reinstating changes in r274628. In l2arc_compress_buf(), we allocate a buffer to stash away the compres= sed data in 'cdata', allocated of l2hdr->b_asize bytes. We then ask zio_compress_data() to compress the buffer, b_l1hdr.b_tmp_cdata, which is of l2hdr->b_asize bytes, and have the compressed size (or original size, if compress didn't gain enough) stored in csize. To pad the buffer to fit the optimal write size, we round up the compressed size to L2 device's vdev_ashift. Illumos code rounds up the size by at most SPA_MINBLOCKSIZE. Because w= e know csize <=3D b_asize, and b_asize is integer multiple of SPA_MINBLOCKSIZE, we are guaranteed that the rounded up csize would be <=3D b_asize. Howe= ver, this is not necessarily true when we round up to 1 << vdev_ashift, beca= use it could be larger than SPA_MINBLOCKSIZE. So, in the worst case scenario, we are overwriting at most (1 << vdev_ashift - SPA_MINBLOCKSIZE) bytes of memory next to the compressed data buffer. Andriy's original change in r274628 reorganized the code a little bit, by moving the padding to after we determined that the compression was beneficial. At which point, we would check rounded size against the allocated buffer size, and the buffer overrun would not be possible. Modified: head/sys/cddl/contrib/opensolaris/uts/common/fs/zfs/arc.c Cheers, --a1Mj4oE6IBTRJNqvgx1CnCTDId9wr8DJe Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- iQIcBAEBCgAGBQJV4YNrAAoJEJW2GBstM+nsoHUP/if6asTTKfFRG0f7kWmZKurV IqOU0SL1oLGDgWeAi4k5JPceYd8fktRIsMmkKhh8A+slI5bwpUSv4oR63bePSTZm +Fe+ZkwF0coqnK+grPwmFE9PtWV0czVlQPtcqKmDK8jSiZrQ2UsoKkordk8DbfVZ X7vD3bpNIQProzeh+V/d3lktz8oUcnE1+4/3y+IxWpLIcFwvxvv3THCJuEDgki3R EWTRMxRWCn1RfvqO/PFaA9XXmRsMfGUjibhFLzJe2ens95jqOfv5C/eUT36N+OUB Hngdi4Xc/0MtOMWCNUp2f0ppvZQtm+teIad02B28pxiuZLT7Wu99CkSqDLNH/rvs xemGmNCzyR9NiyqXwsila7wV/+fAELnbp0Tpdi+4fDwosXs+PbF+bMn8SzJ38oI3 GxdURAHUF1V4j32Pz0iMs0X45ZljHBOYZeZN1y2gxNwr5mb4vEAe5rPCaBd8Jdii ib9N/+nh+cwvv9+jrPz+vXWqv2v1pM2x1PQOeP2WPCOPvFQzd6nqp4X4McAC2WLr dDCOeOdOhYc0rN02nc/twrHmXjL0QjX3aL6fFGQpHP0Y04zW34hP9VfdpGGWBvcp gGUAGMWIFJNOw+w3V0ywqObnPoL0+9ubzMlKbcIhr18XEv0q2dYBiJo5dNLBR+i3 zQh7CjruHEi7FBB8S21F =7c7H -----END PGP SIGNATURE----- --a1Mj4oE6IBTRJNqvgx1CnCTDId9wr8DJe--
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?55E1836B.6040107>