ffs: Avoid out-of-bounds accesses in the fs_active bitmap
We use a bitmap to track which cylinder groups have changed between snapshot creation and filesystem suspension. The "legs" of the bitmap are four bytes wide (see ACTIVESET()) so we must round up the allocation size to a multiple of four bytes. I believe this bug is harmless since UMA/kmem_* will both pad the allocation and zero the full allocation. Note that malloc() does inline zeroing when the allocation size is known at compile-time. Reported by: pho (using KASAN) Reviewed by: kib, mckusick MFC after: 1 week Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D27731
This commit is contained in:
parent
0120603891
commit
ace3d9475c
@ -385,8 +385,8 @@ ffs_snapshot(mp, snapfile)
|
||||
* touch up the few cylinder groups that changed during
|
||||
* the suspension period.
|
||||
*/
|
||||
len = howmany(fs->fs_ncg, NBBY);
|
||||
space = malloc(len, M_DEVBUF, M_WAITOK|M_ZERO);
|
||||
len = roundup2(howmany(fs->fs_ncg, NBBY), sizeof(int));
|
||||
space = malloc(len, M_DEVBUF, M_WAITOK | M_ZERO);
|
||||
UFS_LOCK(ump);
|
||||
fs->fs_active = space;
|
||||
UFS_UNLOCK(ump);
|
||||
|
Loading…
Reference in New Issue
Block a user