Date: Thu, 2 Feb 2012 16:18:41 +0000 (UTC) From: Martin Matuska <mm@FreeBSD.org> To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org Subject: svn commit: r230913 - head/sys/cddl/contrib/opensolaris/uts/common/fs/zfs Message-ID: <201202021618.q12GIf7e044499@svn.freebsd.org>
next in thread | raw e-mail | index | archive | help
Author: mm Date: Thu Feb 2 16:18:40 2012 New Revision: 230913 URL: http://svn.freebsd.org/changeset/base/230913 Log: Fix out of bounds write causing random panics, uncovered by the change in r230256 Reviewed by: pluknet@ MFC after: 3 days Modified: head/sys/cddl/contrib/opensolaris/uts/common/fs/zfs/dnode.c Modified: head/sys/cddl/contrib/opensolaris/uts/common/fs/zfs/dnode.c ============================================================================== --- head/sys/cddl/contrib/opensolaris/uts/common/fs/zfs/dnode.c Thu Feb 2 14:17:58 2012 (r230912) +++ head/sys/cddl/contrib/opensolaris/uts/common/fs/zfs/dnode.c Thu Feb 2 16:18:40 2012 (r230913) @@ -993,7 +993,7 @@ dnode_buf_pageout(dmu_buf_t *db, void *a dnh->dnh_dnode = NULL; } kmem_free(children_dnodes, sizeof (dnode_children_t) + - (epb - 1) * sizeof (dnode_handle_t)); + epb * sizeof (dnode_handle_t)); } /* @@ -1078,7 +1078,7 @@ dnode_hold_impl(objset_t *os, uint64_t o int i; dnode_children_t *winner; children_dnodes = kmem_zalloc(sizeof (dnode_children_t) + - (epb - 1) * sizeof (dnode_handle_t), KM_SLEEP); + epb * sizeof (dnode_handle_t), KM_SLEEP); children_dnodes->dnc_count = epb; dnh = &children_dnodes->dnc_children[0]; for (i = 0; i < epb; i++) { @@ -1088,7 +1088,7 @@ dnode_hold_impl(objset_t *os, uint64_t o if (winner = dmu_buf_set_user(&db->db, children_dnodes, NULL, dnode_buf_pageout)) { kmem_free(children_dnodes, sizeof (dnode_children_t) + - (epb - 1) * sizeof (dnode_handle_t)); + epb * sizeof (dnode_handle_t)); children_dnodes = winner; } }
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201202021618.q12GIf7e044499>