diff options
| author | loli10K <[email protected]> | 2019-01-18 18:58:46 +0100 |
|---|---|---|
| committer | Brian Behlendorf <[email protected]> | 2019-01-18 09:58:46 -0800 |
| commit | 60b0a963f56182beb2d57823960f3ddb987a584a (patch) | |
| tree | c854c58721add4967aae7c4e864251615c535619 /module/zfs/zap_leaf.c | |
| parent | 8dc2197b7b1e4d7ebc1420ea30e51c6541f1d834 (diff) | |
Off-by-one in zap_leaf_array_create()
Trying to set user properties with their length 1 byte shorter than the
maximum size triggers an assertion failure in zap_leaf_array_create():
panic[cpu0]/thread=ffffff000a092c40:
assertion failed: num_integers * integer_size < (8<<10) (0x2000 < 0x2000), file: ../../common/fs/zfs/zap_leaf.c, line: 233
ffffff000a092500 genunix:process_type+167c35 ()
ffffff000a0925a0 zfs:zap_leaf_array_create+1d2 ()
ffffff000a092650 zfs:zap_entry_create+1be ()
ffffff000a092720 zfs:fzap_update+ed ()
ffffff000a0927d0 zfs:zap_update+1a5 ()
ffffff000a0928d0 zfs:dsl_prop_set_sync_impl+5c6 ()
ffffff000a092970 zfs:dsl_props_set_sync_impl+fc ()
ffffff000a0929b0 zfs:dsl_props_set_sync+79 ()
ffffff000a0929f0 zfs:dsl_sync_task_sync+10a ()
ffffff000a092a80 zfs:dsl_pool_sync+3a3 ()
ffffff000a092b50 zfs:spa_sync+4e6 ()
ffffff000a092c20 zfs:txg_sync_thread+297 ()
ffffff000a092c30 unix:thread_start+8 ()
This patch simply corrects the assertion.
Reviewed-by: Matt Ahrens <[email protected]>
Reviewed-by: Brian Behlendorf <[email protected]>
Signed-off-by: loli10K <[email protected]>
Closes #8278
Diffstat (limited to 'module/zfs/zap_leaf.c')
| -rw-r--r-- | module/zfs/zap_leaf.c | 5 |
1 files changed, 1 insertions, 4 deletions
diff --git a/module/zfs/zap_leaf.c b/module/zfs/zap_leaf.c index d168ad29a..b421dd503 100644 --- a/module/zfs/zap_leaf.c +++ b/module/zfs/zap_leaf.c @@ -45,9 +45,6 @@ static uint16_t *zap_leaf_rehash_entry(zap_leaf_t *l, uint16_t entry); #define CHAIN_END 0xffff /* end of the chunk chain */ -/* half the (current) minimum block size */ -#define MAX_ARRAY_BYTES (8<<10) - #define LEAF_HASH(l, h) \ ((ZAP_LEAF_HASH_NUMENTRIES(l)-1) & \ ((h) >> \ @@ -233,7 +230,7 @@ zap_leaf_array_create(zap_leaf_t *l, const char *buf, int shift = (integer_size - 1) * 8; int len = num_integers; - ASSERT3U(num_integers * integer_size, <, MAX_ARRAY_BYTES); + ASSERT3U(num_integers * integer_size, <=, ZAP_MAXVALUELEN); while (len > 0) { uint16_t chunk = zap_leaf_chunk_alloc(l); |