diff options
| author | Chunwei Chen <[email protected]> | 2016-05-27 15:39:34 -0700 |
|---|---|---|
| committer | Brian Behlendorf <[email protected]> | 2016-05-31 16:01:27 -0700 |
| commit | 540c39279322cb278ad45840f260fe4b92c3c8b7 (patch) | |
| tree | e2922f25b119b8d7de6b118dc944e5c7558236a0 | |
| parent | 2493dca54e18b24bcd8b7ff5432f4dc51dddc472 (diff) | |
Fix out-of-bound access in zfs_fillpage
The original code will do an out-of-bound access on pl[] during last
iteration.
==================================================================
BUG: KASAN: stack-out-of-bounds in zfs_getpage+0x14c/0x2d0 [zfs]
Read of size 8 by task tmpfile/7850
page:ffffea00017c6dc0 count:0 mapcount:0 mapping: (null) index:0x0
flags: 0xffff8000000000()
page dumped because: kasan: bad access detected
CPU: 3 PID: 7850 Comm: tmpfile Tainted: G OE 4.6.0+ #3
ffff88005f1b7678 0000000006dbe035 ffff88005f1b7508 ffffffff81635618
ffff88005f1b7678 ffff88005f1b75a0 ffff88005f1b7590 ffffffff81313ee8
ffffea0001ae8dd0 ffff88005f1b7670 0000000000000246 0000000041b58ab3
Call Trace:
[<ffffffff81635618>] dump_stack+0x63/0x8b
[<ffffffff81313ee8>] kasan_report_error+0x528/0x560
[<ffffffff81278f20>] ? filemap_map_pages+0x5f0/0x5f0
[<ffffffff813144b8>] kasan_report+0x58/0x60
[<ffffffffc12250dc>] ? zfs_getpage+0x14c/0x2d0 [zfs]
[<ffffffff81312e4e>] __asan_load8+0x5e/0x70
[<ffffffffc12250dc>] zfs_getpage+0x14c/0x2d0 [zfs]
[<ffffffffc1252131>] zpl_readpage+0xd1/0x180 [zfs]
[<ffffffff81353c3a>] SyS_execve+0x3a/0x50
[<ffffffff810058ef>] do_syscall_64+0xef/0x180
[<ffffffff81d0ee25>] entry_SYSCALL64_slow_path+0x25/0x25
Memory state around the buggy address:
ffff88005f1b7500: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ffff88005f1b7580: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>ffff88005f1b7600: 00 00 00 00 00 00 00 00 00 00 f1 f1 f1 f1 00 f4
^
ffff88005f1b7680: f4 f4 f3 f3 f3 f3 00 00 00 00 00 00 00 00 00 00
ffff88005f1b7700: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
==================================================================
Signed-off-by: Chunwei Chen <[email protected]>
Signed-off-by: Tony Hutter <[email protected]>
Signed-off-by: Brian Behlendorf <[email protected]>
Closes #4705
Issue #4708
| -rw-r--r-- | module/zfs/zfs_vnops.c | 3 |
1 files changed, 1 insertions, 2 deletions
diff --git a/module/zfs/zfs_vnops.c b/module/zfs/zfs_vnops.c index e53992cbb..48a72e302 100644 --- a/module/zfs/zfs_vnops.c +++ b/module/zfs/zfs_vnops.c @@ -4271,10 +4271,10 @@ zfs_fillpage(struct inode *ip, struct page *pl[], int nr_pages) * Iterate over list of pages and read each page individually. */ page_idx = 0; - cur_pp = pl[0]; for (total = io_off + io_len; io_off < total; io_off += PAGESIZE) { caddr_t va; + cur_pp = pl[page_idx++]; va = kmap(cur_pp); err = dmu_read(os, zp->z_id, io_off, PAGESIZE, va, DMU_READ_PREFETCH); @@ -4285,7 +4285,6 @@ zfs_fillpage(struct inode *ip, struct page *pl[], int nr_pages) err = SET_ERROR(EIO); return (err); } - cur_pp = pl[++page_idx]; } return (0); |