From owner-svn-src-all@FreeBSD.ORG Thu Feb 2 16:18:41 2012 Return-Path: Delivered-To: svn-src-all@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id A21FA1065672; Thu, 2 Feb 2012 16:18:41 +0000 (UTC) (envelope-from mm@FreeBSD.org) Received: from svn.freebsd.org (svn.freebsd.org [IPv6:2001:4f8:fff6::2c]) by mx1.freebsd.org (Postfix) with ESMTP id 8C43F8FC0A; Thu, 2 Feb 2012 16:18:41 +0000 (UTC) Received: from svn.freebsd.org (localhost [127.0.0.1]) by svn.freebsd.org (8.14.4/8.14.4) with ESMTP id q12GIfUZ044501; Thu, 2 Feb 2012 16:18:41 GMT (envelope-from mm@svn.freebsd.org) Received: (from mm@localhost) by svn.freebsd.org (8.14.4/8.14.4/Submit) id q12GIf7e044499; Thu, 2 Feb 2012 16:18:41 GMT (envelope-from mm@svn.freebsd.org) Message-Id: <201202021618.q12GIf7e044499@svn.freebsd.org> From: Martin Matuska Date: Thu, 2 Feb 2012 16:18:41 +0000 (UTC) To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org X-SVN-Group: head MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Cc: Subject: svn commit: r230913 - head/sys/cddl/contrib/opensolaris/uts/common/fs/zfs X-BeenThere: svn-src-all@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: "SVN commit messages for the entire src tree \(except for " user" and " projects" \)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 02 Feb 2012 16:18:41 -0000 Author: mm Date: Thu Feb 2 16:18:40 2012 New Revision: 230913 URL: http://svn.freebsd.org/changeset/base/230913 Log: Fix out of bounds write causing random panics, uncovered by the change in r230256 Reviewed by: pluknet@ MFC after: 3 days Modified: head/sys/cddl/contrib/opensolaris/uts/common/fs/zfs/dnode.c Modified: head/sys/cddl/contrib/opensolaris/uts/common/fs/zfs/dnode.c ============================================================================== --- head/sys/cddl/contrib/opensolaris/uts/common/fs/zfs/dnode.c Thu Feb 2 14:17:58 2012 (r230912) +++ head/sys/cddl/contrib/opensolaris/uts/common/fs/zfs/dnode.c Thu Feb 2 16:18:40 2012 (r230913) @@ -993,7 +993,7 @@ dnode_buf_pageout(dmu_buf_t *db, void *a dnh->dnh_dnode = NULL; } kmem_free(children_dnodes, sizeof (dnode_children_t) + - (epb - 1) * sizeof (dnode_handle_t)); + epb * sizeof (dnode_handle_t)); } /* @@ -1078,7 +1078,7 @@ dnode_hold_impl(objset_t *os, uint64_t o int i; dnode_children_t *winner; children_dnodes = kmem_zalloc(sizeof (dnode_children_t) + - (epb - 1) * sizeof (dnode_handle_t), KM_SLEEP); + epb * sizeof (dnode_handle_t), KM_SLEEP); children_dnodes->dnc_count = epb; dnh = &children_dnodes->dnc_children[0]; for (i = 0; i < epb; i++) { @@ -1088,7 +1088,7 @@ dnode_hold_impl(objset_t *os, uint64_t o if (winner = dmu_buf_set_user(&db->db, children_dnodes, NULL, dnode_buf_pageout)) { kmem_free(children_dnodes, sizeof (dnode_children_t) + - (epb - 1) * sizeof (dnode_handle_t)); + epb * sizeof (dnode_handle_t)); children_dnodes = winner; } }