c/mirror_zfs
1
0
Fork 0
mirror of https://git.proxmox.com/git/mirror_zfs.git synced 2026-05-23 02:44:41 +03:00
Code Issues Packages Projects Releases Wiki Activity

OpenZFS 6314 - buffer overflow in dsl_dataset_name

Browse Source 
Reviewed by: George Wilson <george.wilson@delphix.com>
Reviewed by: Prakash Surya <prakash.surya@delphix.com>
Reviewed by: Igor Kozhukhov <ikozhukhov@gmail.com>
Approved by: Dan McDonald <danmcd@omniti.com>
Ported-by: Brian Behlendorf <behlendorf1@llnl.gov>

OpenZFS-issue: https://www.illumos.org/issues/6314
OpenZFS-commit: https://github.com/openzfs/openzfs/commit/d6160ee
This commit is contained in:
Igor Kozhukhov
2016-06-15 14:28:36 -07:00
committed by Brian Behlendorf
parent 43e52eddb1
commit eca7b76001
41 changed files with 297 additions and 334 deletions
Download Patch File Download Diff File Expand all files Collapse all files
cmd/ztest/ztest.c
+57 -59
View File
@@ -145,8 +145,8 @@ typedef struct ztest_shared_hdr {
static ztest_shared_hdr_t *ztest_shared_hdr;
typedef struct ztest_shared_opts {
char zo_pool[MAXNAMELEN];
char zo_dir[MAXNAMELEN];
char zo_pool[ZFS_MAX_DATASET_NAME_LEN];
char zo_dir[ZFS_MAX_DATASET_NAME_LEN];
char zo_alt_ztest[MAXNAMELEN];
char zo_alt_libpath[MAXNAMELEN];
uint64_t zo_vdevs;
@@ -262,7 +262,7 @@ typedef struct ztest_od {
uint64_t od_crdnodesize;
uint64_t od_gen;
uint64_t od_crgen;
char od_name[MAXNAMELEN];
char od_name[ZFS_MAX_DATASET_NAME_LEN];
} ztest_od_t;
/*
@@ -274,7 +274,7 @@ typedef struct ztest_ds {
rwlock_t zd_zilog_lock;
zilog_t *zd_zilog;
ztest_od_t *zd_od; /* debugging aid */
char zd_name[MAXNAMELEN];
char zd_name[ZFS_MAX_DATASET_NAME_LEN];
kmutex_t zd_dirobj_lock;
rll_t zd_object_lock[ZTEST_OBJECT_LOCKS];
zll_t zd_range_lock[ZTEST_RANGE_LOCKS];
@@ -3504,7 +3504,7 @@ ztest_objset_destroy_cb(const char *name, void *arg)
static boolean_t
ztest_snapshot_create(char *osname, uint64_t id)
{
char snapname[MAXNAMELEN];
char snapname[ZFS_MAX_DATASET_NAME_LEN];
int error;
(void) snprintf(snapname, sizeof (snapname), "%llu", (u_longlong_t)id);
@@ -3524,10 +3524,10 @@ ztest_snapshot_create(char *osname, uint64_t id)
static boolean_t
ztest_snapshot_destroy(char *osname, uint64_t id)
{
char snapname[MAXNAMELEN];
char snapname[ZFS_MAX_DATASET_NAME_LEN];
int error;
(void) snprintf(snapname, MAXNAMELEN, "%s@%llu", osname,
(void) snprintf(snapname, sizeof (snapname), "%s@%llu", osname,
(u_longlong_t)id);
error = dsl_destroy_snapshot(snapname, B_FALSE);
@@ -3544,16 +3544,15 @@ ztest_dmu_objset_create_destroy(ztest_ds_t *zd, uint64_t id)
int iters;
int error;
objset_t *os, *os2;
char *name;
char name[ZFS_MAX_DATASET_NAME_LEN];
zilog_t *zilog;
int i;
zdtmp = umem_alloc(sizeof (ztest_ds_t), UMEM_NOFAIL);
name = umem_alloc(MAXNAMELEN, UMEM_NOFAIL);
(void) rw_rdlock(&ztest_name_lock);
(void) snprintf(name, MAXNAMELEN, "%s/temp_%llu",
(void) snprintf(name, sizeof (name), "%s/temp_%llu",
ztest_opts.zo_pool, (u_longlong_t)id);
/*
@@ -3639,7 +3638,6 @@ ztest_dmu_objset_create_destroy(ztest_ds_t *zd, uint64_t id)
out:
(void) rw_unlock(&ztest_name_lock);
umem_free(name, MAXNAMELEN);
umem_free(zdtmp, sizeof (ztest_ds_t));
}
@@ -3668,22 +3666,22 @@ ztest_dsl_dataset_cleanup(char *osname, uint64_t id)
char *snap3name;
int error;
snap1name = umem_alloc(MAXNAMELEN, UMEM_NOFAIL);
clone1name = umem_alloc(MAXNAMELEN, UMEM_NOFAIL);
snap2name = umem_alloc(MAXNAMELEN, UMEM_NOFAIL);
clone2name = umem_alloc(MAXNAMELEN, UMEM_NOFAIL);
snap3name = umem_alloc(MAXNAMELEN, UMEM_NOFAIL);
snap1name = umem_alloc(ZFS_MAX_DATASET_NAME_LEN, UMEM_NOFAIL);
clone1name = umem_alloc(ZFS_MAX_DATASET_NAME_LEN, UMEM_NOFAIL);
snap2name = umem_alloc(ZFS_MAX_DATASET_NAME_LEN, UMEM_NOFAIL);
clone2name = umem_alloc(ZFS_MAX_DATASET_NAME_LEN, UMEM_NOFAIL);
snap3name = umem_alloc(ZFS_MAX_DATASET_NAME_LEN, UMEM_NOFAIL);
(void) snprintf(snap1name, MAXNAMELEN, "%s@s1_%llu",
osname, (u_longlong_t)id);
(void) snprintf(clone1name, MAXNAMELEN, "%s/c1_%llu",
osname, (u_longlong_t)id);
(void) snprintf(snap2name, MAXNAMELEN, "%s@s2_%llu",
clone1name, (u_longlong_t)id);
(void) snprintf(clone2name, MAXNAMELEN, "%s/c2_%llu",
osname, (u_longlong_t)id);
(void) snprintf(snap3name, MAXNAMELEN, "%s@s3_%llu",
clone1name, (u_longlong_t)id);
(void) snprintf(snap1name, ZFS_MAX_DATASET_NAME_LEN,
"%s@s1_%llu", osname, (u_longlong_t)id);
(void) snprintf(clone1name, ZFS_MAX_DATASET_NAME_LEN,
"%s/c1_%llu", osname, (u_longlong_t)id);
(void) snprintf(snap2name, ZFS_MAX_DATASET_NAME_LEN,
"%s@s2_%llu", clone1name, (u_longlong_t)id);
(void) snprintf(clone2name, ZFS_MAX_DATASET_NAME_LEN,
"%s/c2_%llu", osname, (u_longlong_t)id);
(void) snprintf(snap3name, ZFS_MAX_DATASET_NAME_LEN,
"%s@s3_%llu", clone1name, (u_longlong_t)id);
error = dsl_destroy_head(clone2name);
if (error && error != ENOENT)
@@ -3701,11 +3699,11 @@ ztest_dsl_dataset_cleanup(char *osname, uint64_t id)
if (error && error != ENOENT)
fatal(0, "dsl_destroy_snapshot(%s) = %d", snap1name, error);
umem_free(snap1name, MAXNAMELEN);
umem_free(clone1name, MAXNAMELEN);
umem_free(snap2name, MAXNAMELEN);
umem_free(clone2name, MAXNAMELEN);
umem_free(snap3name, MAXNAMELEN);
umem_free(snap1name, ZFS_MAX_DATASET_NAME_LEN);
umem_free(clone1name, ZFS_MAX_DATASET_NAME_LEN);
umem_free(snap2name, ZFS_MAX_DATASET_NAME_LEN);
umem_free(clone2name, ZFS_MAX_DATASET_NAME_LEN);
umem_free(snap3name, ZFS_MAX_DATASET_NAME_LEN);
}
/*
@@ -3723,26 +3721,26 @@ ztest_dsl_dataset_promote_busy(ztest_ds_t *zd, uint64_t id)
char *osname = zd->zd_name;
int error;
snap1name = umem_alloc(MAXNAMELEN, UMEM_NOFAIL);
clone1name = umem_alloc(MAXNAMELEN, UMEM_NOFAIL);
snap2name = umem_alloc(MAXNAMELEN, UMEM_NOFAIL);
clone2name = umem_alloc(MAXNAMELEN, UMEM_NOFAIL);
snap3name = umem_alloc(MAXNAMELEN, UMEM_NOFAIL);
snap1name = umem_alloc(ZFS_MAX_DATASET_NAME_LEN, UMEM_NOFAIL);
clone1name = umem_alloc(ZFS_MAX_DATASET_NAME_LEN, UMEM_NOFAIL);
snap2name = umem_alloc(ZFS_MAX_DATASET_NAME_LEN, UMEM_NOFAIL);
clone2name = umem_alloc(ZFS_MAX_DATASET_NAME_LEN, UMEM_NOFAIL);
snap3name = umem_alloc(ZFS_MAX_DATASET_NAME_LEN, UMEM_NOFAIL);
(void) rw_rdlock(&ztest_name_lock);
ztest_dsl_dataset_cleanup(osname, id);
(void) snprintf(snap1name, MAXNAMELEN, "%s@s1_%llu",
osname, (u_longlong_t)id);
(void) snprintf(clone1name, MAXNAMELEN, "%s/c1_%llu",
osname, (u_longlong_t)id);
(void) snprintf(snap2name, MAXNAMELEN, "%s@s2_%llu",
clone1name, (u_longlong_t)id);
(void) snprintf(clone2name, MAXNAMELEN, "%s/c2_%llu",
osname, (u_longlong_t)id);
(void) snprintf(snap3name, MAXNAMELEN, "%s@s3_%llu",
clone1name, (u_longlong_t)id);
(void) snprintf(snap1name, ZFS_MAX_DATASET_NAME_LEN,
"%s@s1_%llu", osname, (u_longlong_t)id);
(void) snprintf(clone1name, ZFS_MAX_DATASET_NAME_LEN,
"%s/c1_%llu", osname, (u_longlong_t)id);
(void) snprintf(snap2name, ZFS_MAX_DATASET_NAME_LEN,
"%s@s2_%llu", clone1name, (u_longlong_t)id);
(void) snprintf(clone2name, ZFS_MAX_DATASET_NAME_LEN,
"%s/c2_%llu", osname, (u_longlong_t)id);
(void) snprintf(snap3name, ZFS_MAX_DATASET_NAME_LEN,
"%s@s3_%llu", clone1name, (u_longlong_t)id);
error = dmu_objset_snapshot_one(osname, strchr(snap1name, '@') + 1);
if (error && error != EEXIST) {
@@ -3808,11 +3806,11 @@ out:
(void) rw_unlock(&ztest_name_lock);
umem_free(snap1name, MAXNAMELEN);
umem_free(clone1name, MAXNAMELEN);
umem_free(snap2name, MAXNAMELEN);
umem_free(clone2name, MAXNAMELEN);
umem_free(snap3name, MAXNAMELEN);
umem_free(snap1name, ZFS_MAX_DATASET_NAME_LEN);
umem_free(clone1name, ZFS_MAX_DATASET_NAME_LEN);
umem_free(snap2name, ZFS_MAX_DATASET_NAME_LEN);
umem_free(clone2name, ZFS_MAX_DATASET_NAME_LEN);
umem_free(snap3name, ZFS_MAX_DATASET_NAME_LEN);
}
#undef OD_ARRAY_SIZE
@@ -4622,7 +4620,7 @@ ztest_fzap(ztest_ds_t *zd, uint64_t id)
* 2050 entries we should see ptrtbl growth and leaf-block split.
*/
for (i = 0; i < 2050; i++) {
char name[MAXNAMELEN];
char name[ZFS_MAX_DATASET_NAME_LEN];
uint64_t value = i;
dmu_tx_t *tx;
int error;
@@ -5077,7 +5075,7 @@ ztest_dmu_snapshot_hold(ztest_ds_t *zd, uint64_t id)
char fullname[100];
char clonename[100];
char tag[100];
char osname[MAXNAMELEN];
char osname[ZFS_MAX_DATASET_NAME_LEN];
nvlist_t *holds;
(void) rw_rdlock(&ztest_name_lock);
@@ -5964,13 +5962,13 @@ ztest_thread(void *arg)
static void
ztest_dataset_name(char *dsname, char *pool, int d)
{
(void) snprintf(dsname, MAXNAMELEN, "%s/ds_%d", pool, d);
(void) snprintf(dsname, ZFS_MAX_DATASET_NAME_LEN, "%s/ds_%d", pool, d);
}
static void
ztest_dataset_destroy(int d)
{
char name[MAXNAMELEN];
char name[ZFS_MAX_DATASET_NAME_LEN];
int t;
ztest_dataset_name(name, ztest_opts.zo_pool, d);
@@ -6019,7 +6017,7 @@ ztest_dataset_open(int d)
uint64_t committed_seq = ZTEST_GET_SHARED_DS(d)->zd_seq;
objset_t *os;
zilog_t *zilog;
char name[MAXNAMELEN];
char name[ZFS_MAX_DATASET_NAME_LEN];
int error;
ztest_dataset_name(name, ztest_opts.zo_pool, d);
@@ -6256,8 +6254,8 @@ ztest_run(ztest_shared_t *zs)
* different name.
*/
if (ztest_random(2) == 0) {
char name[MAXNAMELEN];
(void) snprintf(name, MAXNAMELEN, "%s_import",
char name[ZFS_MAX_DATASET_NAME_LEN];
(void) snprintf(name, sizeof (name), "%s_import",
ztest_opts.zo_pool);
ztest_spa_import_export(ztest_opts.zo_pool, name);
ztest_spa_import_export(name, ztest_opts.zo_pool);
@@ -6834,7 +6832,7 @@ main(int argc, char **argv)
if (spa_open(ztest_opts.zo_pool, &spa, FTAG) == 0) {
spa_close(spa, FTAG);
} else {
char tmpname[MAXNAMELEN];
char tmpname[ZFS_MAX_DATASET_NAME_LEN];
kernel_fini();
kernel_init(FREAD | FWRITE);
(void) snprintf(tmpname, sizeof (tmpname), "%s_tmp",