c/mirror_zfs
1
0
Fork 0
mirror of https://git.proxmox.com/git/mirror_zfs.git synced 2024-12-25 18:59:33 +03:00
Code Issues Packages Projects Releases Wiki Activity

Illumos #4089 NULL pointer dereference in arc_read()

Browse Source 
4089 NULL pointer dereference in arc_read()

Reviewed by: Matthew Ahrens <mahrens@delphix.com>
Reviewed by: Saso Kiselkov <skiselkov.ml@gmail.com>
Reviewed by: Garrett D'Amore <garrett@damore.org>
Approved by: Dan McDonald <danmcd@nexenta.com>

References:
  https://www.illumos.org/issues/4089
  illumos/illumos-gate@57815f6b95

Signed-off-by: Brian Behlendorf <behlendorf1@llnl.gov>
Issue #2171
Issue #2165
Closes #2198
This commit is contained in:
Boris Protopopov 2014-03-20 16:55:09 -07:00 committed by Brian Behlendorf
parent d3773fda14
commit 0ed212dc0e
1 changed files with 11 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

20
module/zfs/arc.c
View File

@ -20,9 +20,9 @@
*/ */
/* /*
* Copyright (c) 2005, 2010, Oracle and/or its affiliates. All rights reserved. * Copyright (c) 2005, 2010, Oracle and/or its affiliates. All rights reserved.
* Copyright 2011 Nexenta Systems, Inc. All rights reserved.
* Copyright (c) 2013 by Delphix. All rights reserved. * Copyright (c) 2013 by Delphix. All rights reserved.
* Copyright (c) 2013 by Saso Kiselkov. All rights reserved. * Copyright (c) 2013 by Saso Kiselkov. All rights reserved.
* Copyright 2013 Nexenta Systems, Inc. All rights reserved.
*/ */
/* /*
@ -3268,6 +3268,8 @@ top:
vdev_t *vd = NULL; vdev_t *vd = NULL;
uint64_t addr = 0; uint64_t addr = 0;
boolean_t devw = B_FALSE; boolean_t devw = B_FALSE;
enum zio_compress b_compress = ZIO_COMPRESS_OFF;
uint64_t b_asize = 0;
if (hdr == NULL) { if (hdr == NULL) {
/* this block is not in the cache */ /* this block is not in the cache */
@ -3337,10 +3339,12 @@ top:
hdr->b_acb = acb; hdr->b_acb = acb;
hdr->b_flags |= ARC_IO_IN_PROGRESS; hdr->b_flags |= ARC_IO_IN_PROGRESS;
if (HDR_L2CACHE(hdr) && hdr->b_l2hdr != NULL && if (hdr->b_l2hdr != NULL &&
(vd = hdr->b_l2hdr->b_dev->l2ad_vdev) != NULL) { (vd = hdr->b_l2hdr->b_dev->l2ad_vdev) != NULL) {
devw = hdr->b_l2hdr->b_dev->l2ad_writing; devw = hdr->b_l2hdr->b_dev->l2ad_writing;
addr = hdr->b_l2hdr->b_daddr; addr = hdr->b_l2hdr->b_daddr;
b_compress = hdr->b_l2hdr->b_compress;
b_asize = hdr->b_l2hdr->b_asize;
/* /*
* Lock out device removal. * Lock out device removal.
*/ */
@ -3389,7 +3393,7 @@ top:
cb->l2rcb_bp = *bp; cb->l2rcb_bp = *bp;
cb->l2rcb_zb = *zb; cb->l2rcb_zb = *zb;
cb->l2rcb_flags = zio_flags; cb->l2rcb_flags = zio_flags;
cb->l2rcb_compress = hdr->b_l2hdr->b_compress; cb->l2rcb_compress = b_compress;
ASSERT(addr >= VDEV_LABEL_START_SIZE && ASSERT(addr >= VDEV_LABEL_START_SIZE &&
addr + size < vd->vdev_psize - addr + size < vd->vdev_psize -
@ -3401,8 +3405,7 @@ top:
* Issue a null zio if the underlying buffer * Issue a null zio if the underlying buffer
* was squashed to zero size by compression. * was squashed to zero size by compression.
*/ */
if (hdr->b_l2hdr->b_compress == if (b_compress == ZIO_COMPRESS_EMPTY) {
ZIO_COMPRESS_EMPTY) {
rzio = zio_null(pio, spa, vd, rzio = zio_null(pio, spa, vd,
l2arc_read_done, cb, l2arc_read_done, cb,
zio_flags | ZIO_FLAG_DONT_CACHE | zio_flags | ZIO_FLAG_DONT_CACHE |
@ -3411,8 +3414,8 @@ top:
ZIO_FLAG_DONT_RETRY); ZIO_FLAG_DONT_RETRY);
} else { } else {
rzio = zio_read_phys(pio, vd, addr, rzio = zio_read_phys(pio, vd, addr,
hdr->b_l2hdr->b_asize, b_asize, buf->b_data,
buf->b_data, ZIO_CHECKSUM_OFF, ZIO_CHECKSUM_OFF,
l2arc_read_done, cb, priority, l2arc_read_done, cb, priority,
zio_flags | ZIO_FLAG_DONT_CACHE | zio_flags | ZIO_FLAG_DONT_CACHE |
ZIO_FLAG_CANFAIL | ZIO_FLAG_CANFAIL |
@ -3421,8 +3424,7 @@ top:
} }
DTRACE_PROBE2(l2arc__read, vdev_t *, vd, DTRACE_PROBE2(l2arc__read, vdev_t *, vd,
zio_t *, rzio); zio_t *, rzio);
ARCSTAT_INCR(arcstat_l2_read_bytes, ARCSTAT_INCR(arcstat_l2_read_bytes, b_asize);
hdr->b_l2hdr->b_asize);
if (*arc_flags & ARC_NOWAIT) { if (*arc_flags & ARC_NOWAIT) {
zio_nowait(rzio); zio_nowait(rzio);