Author: mm
Date: Thu Feb 2 16:18:40 2012
New Revision: 230913
URL: http://svn.freebsd.org/changeset/base/230913
Log:
Fix out of bounds write causing random panics,
uncovered by the change in r230256
Reviewed by: pluknet@
MFC after: 3 days
Modified:
head/sys/cddl/contrib/opensolaris/uts/common/fs/zfs/dnode.c
Modified: head/sys/cddl/contrib/opensolaris/uts/common/fs/zfs/dnode.c
==============================================================================
--- head/sys/cddl/contrib/opensolaris/uts/common/fs/zfs/dnode.c Thu Feb 2
14:17:58 2012 (r230912)
+++ head/sys/cddl/contrib/opensolaris/uts/common/fs/zfs/dnode.c Thu Feb 2
16:18:40 2012 (r230913)
@@ -993,7 +993,7 @@ dnode_buf_pageout(dmu_buf_t *db, void *a
dnh->dnh_dnode = NULL;
}
kmem_free(children_dnodes, sizeof (dnode_children_t) +
- (epb - 1) * sizeof (dnode_handle_t));
+ epb * sizeof (dnode_handle_t));
}
/*
@@ -1078,7 +1078,7 @@ dnode_hold_impl(objset_t *os, uint64_t o
int i;
dnode_children_t *winner;
children_dnodes = kmem_zalloc(sizeof (dnode_children_t) +
- (epb - 1) * sizeof (dnode_handle_t), KM_SLEEP);
+ epb * sizeof (dnode_handle_t), KM_SLEEP);
children_dnodes->dnc_count = epb;
dnh = &children_dnodes->dnc_children[0];
for (i = 0; i < epb; i++) {
@@ -1088,7 +1088,7 @@ dnode_hold_impl(objset_t *os, uint64_t o
if (winner = dmu_buf_set_user(&db->db, children_dnodes, NULL,
dnode_buf_pageout)) {
kmem_free(children_dnodes, sizeof (dnode_children_t) +
- (epb - 1) * sizeof (dnode_handle_t));
+ epb * sizeof (dnode_handle_t));
children_dnodes = winner;
}
}
_______________________________________________
[email protected] mailing list
http://lists.freebsd.org/mailman/listinfo/svn-src-all
To unsubscribe, send any mail to "[email protected]"
