c/mirror_zfs
1
0
Fork 0
mirror of https://git.proxmox.com/git/mirror_zfs.git synced 2025-01-27 02:14:28 +03:00
Code Issues Packages Projects Releases Wiki Activity
43b4935e53
mirror_zfs/module/zfs
History
Ned Bass 43b4935e53 Prevent SA length overflow 
The function sa_update() accepts a 32-bit length parameter and
assigns it to a 16-bit field in sa_bulk_attr_t, potentially
truncating the passed-in value. This could lead to corrupt system
attribute (SA) records getting written to the pool. Add a VERIFY to
sa_update() to detect cases where overflow would occur. The SA length
is limited to 16-bit values by the on-disk format defined by
sa_hdr_phys_t.

The function zfs_sa_set_xattr() is vulnerable to this bug if the
unpacked nvlist of xattrs is less than 64k in size but the packed
size is greater than 64k. Fix this by appropriately checking the
size of the packed nvlist before calling sa_update(). Add error
handling to zpl_xattr_set_sa() to keep the cached list of SA-based
xattrs consistent with the data on disk.

Lastly, zfs_sa_set_xattr() calls dmu_tx_abort() on an assigned
transaction if sa_update() returns an error, but the DMU only allows
unassigned transactions to be aborted. Wrap the sa_update() call in a
VERIFY0, remove the transaction abort, and call dmu_tx_commit()
unconditionally. This is consistent practice with other callers
of sa_update().

Signed-off-by: Ned Bass <bass6@llnl.gov>
Signed-off-by: Brian Behlendorf <behlendorf1@llnl.gov>
Signed-off-by: Richard Yao <ryao@gentoo.org>
Closes #4150
2015-12-30 13:20:12 -08:00
..
arc.c Handle block pointers with a corrupt logical size 2015-12-15 16:11:44 -08:00
blkptr.c Illumos 4757, 4913 2014-08-01 14:28:05 -07:00
bplist.c Change KM_PUSHPAGE -> KM_SLEEP 2015-01-16 14:41:26 -08:00
bpobj.c Illumos 5810 - zdb should print details of bpobj 2015-05-11 15:10:24 -07:00
bptree.c Illumos 5027 - zfs large block support 2015-05-11 12:23:16 -07:00
dbuf_stats.c Illumos 5497 - lock contention on arcs_mtx 2015-06-11 10:27:25 -07:00
dbuf.c Identify locks flagged by lockdep 2015-12-22 10:21:33 -08:00
ddt_zap.c Change KM_PUSHPAGE -> KM_SLEEP 2015-01-16 14:41:26 -08:00
ddt.c Handle zap_lookup() failure in ddt_object_load() 2015-08-19 14:32:50 -07:00
dmu_diff.c Illumos 5369 - arc flags should be an enum 2015-06-11 10:27:25 -07:00
dmu_object.c Illumos 3693 - restore_object uses at least two transactions to restore an object 2014-10-21 15:26:50 -07:00
dmu_objset.c Illumos 6267 - dn_bonus evicted too early 2015-10-13 14:12:02 -07:00
dmu_send.c Use large stacks when available 2015-12-07 12:20:43 -08:00
dmu_traverse.c Prevent reclaim in the traverse prefetch thread 2015-09-04 08:43:28 -07:00
dmu_tx.c Illumos 5911 - ZFS "hangs" while deleting file 2015-07-06 09:31:42 -07:00
dmu_zfetch.c Change KM_PUSHPAGE -> KM_SLEEP 2015-01-16 14:41:26 -08:00
dmu.c Use uio for zvol_{read,write} 2015-12-15 16:21:43 -08:00
dnode_sync.c Illumos 6267 - dn_bonus evicted too early 2015-10-13 14:12:02 -07:00
dnode.c Identify locks flagged by lockdep 2015-12-22 10:21:33 -08:00
dsl_bookmark.c Illumos 4951 - ZFS administrative commands should use reserved space 2015-05-04 09:41:10 -07:00
dsl_dataset.c Illumos 5959 - clean up per-dataset feature count code 2015-12-04 14:20:20 -08:00
dsl_deadlist.c Handle damaged blk_birth in dsl_deadlist_insert() 2015-12-15 16:12:31 -08:00
dsl_deleg.c Illumos 4951 - ZFS administrative commands should use reserved space 2015-05-04 09:41:10 -07:00
dsl_destroy.c Illumos 5959 - clean up per-dataset feature count code 2015-12-04 14:20:20 -08:00
dsl_dir.c Illumos 4951 - ZFS administrative commands should use reserved space 2015-05-04 09:41:10 -07:00
dsl_pool.c Align thread priority with Linux defaults 2015-07-28 13:36:47 -07:00
dsl_prop.c Illumos 4951 - ZFS administrative commands should use reserved space 2015-05-04 09:41:10 -07:00
dsl_scan.c Illumos 5347 - idle pool may run itself out of space 2015-07-14 10:35:21 -07:00
dsl_synctask.c Illumos 4951 - ZFS administrative commands should use reserved space 2015-05-04 09:41:10 -07:00
dsl_userhold.c Illumos 4951 - ZFS administrative commands should use reserved space 2015-05-04 09:41:10 -07:00
fm.c zfsdev_getminor() should check for invalid file handles 2015-06-22 17:02:13 -07:00
gzip.c cstyle: Resolve C style issues 2013-12-18 16:46:35 -08:00
lz4.c Change KM_PUSHPAGE -> KM_SLEEP 2015-01-16 14:41:26 -08:00
lzjb.c Change KM_PUSHPAGE -> KM_SLEEP 2015-01-16 14:41:26 -08:00
Makefile.in Support parallel build trees (VPATH builds) 2015-07-17 13:42:51 -07:00
metaslab.c Disable LBA weighting on files and SSDs 2015-09-01 15:22:07 -07:00
multilist.c Identify locks flagged by lockdep 2015-12-22 10:21:33 -08:00
range_tree.c Illumos 5163 - arc should reap range_seg_cache 2015-06-25 08:58:16 -07:00
refcount.c Change KM_PUSHPAGE -> KM_SLEEP 2015-01-16 14:41:26 -08:00
rrwlock.c Illumos 5008 - lock contention (rrw_exit) while running a read only load 2015-07-06 09:34:13 -07:00
sa.c Prevent SA length overflow 2015-12-30 13:20:12 -08:00
sha256.c Add linux sha2 support 2010-08-31 13:41:59 -07:00
spa_boot.c Add linux kernel module support 2010-08-31 13:41:58 -07:00
spa_config.c Fix ztest truncated cache file 2015-12-22 10:40:40 -08:00
spa_errlog.c Illumos 4914 - zfs on-disk bookmark structure should be named *_phys_t 2014-08-06 14:48:41 -07:00
spa_history.c Illumos 5027 - zfs large block support 2015-05-11 12:23:16 -07:00
spa_misc.c Add spa_slop_shift module option 2015-09-02 09:30:18 -07:00
spa_stats.c Illumos 5369 - arc flags should be an enum 2015-06-11 10:27:25 -07:00
spa.c Make zio_taskq_batch_pct user configurable 2015-12-18 13:46:23 -08:00
space_map.c Change KM_PUSHPAGE -> KM_SLEEP 2015-01-16 14:41:26 -08:00
space_reftree.c Change KM_PUSHPAGE -> KM_SLEEP 2015-01-16 14:41:26 -08:00
trace.c Illumos 5497 - lock contention on arcs_mtx 2015-06-11 10:27:25 -07:00
txg.c Identify locks flagged by lockdep 2015-12-22 10:21:33 -08:00
uberblock.c Illumos 5347 - idle pool may run itself out of space 2015-07-14 10:35:21 -07:00
unique.c Change KM_PUSHPAGE -> KM_SLEEP 2015-01-16 14:41:26 -08:00
vdev_cache.c Change KM_PUSHPAGE -> KM_SLEEP 2015-01-16 14:41:26 -08:00
vdev_disk.c Fix use-after-free in vdev_disk_physio_completion 2015-10-13 15:25:33 -07:00
vdev_file.c Disable LBA weighting on files and SSDs 2015-09-01 15:22:07 -07:00
vdev_label.c Change KM_PUSHPAGE -> KM_SLEEP 2015-01-16 14:41:26 -08:00
vdev_mirror.c Illumos #5244 - zio pipeline callers should explicitly invoke next stage 2015-04-30 15:07:47 -07:00
vdev_missing.c Illumos #5244 - zio pipeline callers should explicitly invoke next stage 2015-04-30 15:07:47 -07:00
vdev_queue.c Fix zfs_vdev_aggregation_limit bounds checking 2015-12-18 13:32:06 -08:00
vdev_raidz.c Illumos #5244 - zio pipeline callers should explicitly invoke next stage 2015-04-30 15:07:47 -07:00
vdev_root.c Illumos #3598 2013-10-31 14:58:04 -07:00
vdev.c Identify locks flagged by lockdep 2015-12-22 10:21:33 -08:00
zap_leaf.c Illumos 5314 - Remove "dbuf phys" db->db_data pointer aliases in ZFS 2015-04-28 16:25:20 -07:00
zap_micro.c Add zap_prefetch() interface 2015-12-04 09:39:20 -08:00
zap.c Fix empty xattr dir causing lockup 2015-12-28 09:41:30 -08:00
zfeature_common.c Illumos 5959 - clean up per-dataset feature count code 2015-12-04 14:20:20 -08:00
zfeature.c Illumos 5959 - clean up per-dataset feature count code 2015-12-04 14:20:20 -08:00
zfs_acl.c Change KM_PUSHPAGE -> KM_SLEEP 2015-01-16 14:41:26 -08:00
zfs_byteswap.c Add linux kernel module support 2010-08-31 13:41:58 -07:00
zfs_ctldir.c Hold the zfs_snapentry_t before dispatch 2015-12-14 12:06:31 -08:00
zfs_debug.c Add dbgmsg kstat 2015-09-04 16:08:14 -07:00
zfs_dir.c Make xattr dir truncate and remove in one tx 2015-12-28 09:48:26 -08:00
zfs_fm.c Change KM_PUSHPAGE -> KM_SLEEP 2015-01-16 14:41:26 -08:00
zfs_fuid.c Illumos #3522 2013-10-30 14:51:27 -07:00
zfs_ioctl.c Follow 0/-E convention for module load errors 2015-11-16 16:10:06 -08:00
zfs_log.c Illumos 5027 - zfs large block support 2015-05-11 12:23:16 -07:00
zfs_onexit.c zfsdev_getminor() should check for invalid file handles 2015-06-22 17:02:13 -07:00
zfs_replay.c Linux AIO Support 2014-09-05 15:11:43 -07:00
zfs_rlock.c Change KM_PUSHPAGE -> KM_SLEEP 2015-01-16 14:41:26 -08:00
zfs_sa.c Prevent SA length overflow 2015-12-30 13:20:12 -08:00
zfs_vfsops.c Support accessing .zfs/snapshot via NFS 2015-09-04 13:23:53 -07:00
zfs_vnops.c Fix invalid fileid for snapshot root dentry 2015-09-04 13:23:06 -07:00
zfs_znode.c Revert "Fix z_xattr_lock/z_teardown_lock lock inversion" 2015-12-22 16:58:43 -08:00
zil.c Align thread priority with Linux defaults 2015-07-28 13:36:47 -07:00
zio_checksum.c Illumos 4757, 4913 2014-08-01 14:28:05 -07:00
zio_compress.c Illumos 5661 - ZFS: "compression = on" should use lz4 if feature is enabled 2015-07-10 12:11:45 -07:00
zio_inject.c Illumos 5497 - lock contention on arcs_mtx 2015-06-11 10:27:25 -07:00
zio.c Identify locks flagged by lockdep 2015-12-22 10:21:33 -08:00
zle.c Update core ZFS code from build 121 to build 141. 2010-05-28 13:45:14 -07:00
zpl_ctldir.c Linux 3.18 compat: Snapshot auto-mounting 2015-08-31 13:54:39 -07:00
zpl_export.c zfsctl: No need to sync ctldir inodes 2015-08-31 13:54:39 -07:00
zpl_file.c Linux 4.1 compat: loop device on ZFS 2015-08-24 10:17:06 -07:00
zpl_inode.c Use spa as key besides objsetid for snapentry 2015-12-08 16:38:56 -08:00
zpl_super.c Disable zpl_nr_cached_objects() callback 2015-09-25 12:45:42 -07:00
zpl_xattr.c Prevent SA length overflow 2015-12-30 13:20:12 -08:00
zrlock.c Illumos 5812 - assertion failed in zrl_tryenter(): zr_owner==NULL 2015-04-30 14:43:40 -07:00
zvol.c Use uio for zvol_{read,write} 2015-12-15 16:21:43 -08:00