d/freebsd-skq
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

MFV r258378: 4089 NULL pointer dereference in arc_read()

Browse Source 
illumos/illumos-gate@57815f6b95

Tested by:	adrian
MFC after:	4 days
This commit is contained in:
avg 2013-11-20 11:52:32 +00:00
parent 64efe866e5
commit 5499e7013c
1 changed files with 11 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

20
sys/cddl/contrib/opensolaris/uts/common/fs/zfs/arc.c
View File

@ -20,9 +20,9 @@
*/ */
/* /*
* Copyright (c) 2005, 2010, Oracle and/or its affiliates. All rights reserved. * Copyright (c) 2005, 2010, Oracle and/or its affiliates. All rights reserved.
* Copyright 2011 Nexenta Systems, Inc. All rights reserved.
* Copyright (c) 2013 by Delphix. All rights reserved. * Copyright (c) 2013 by Delphix. All rights reserved.
* Copyright (c) 2013 by Saso Kiselkov. All rights reserved. * Copyright (c) 2013 by Saso Kiselkov. All rights reserved.
* Copyright 2013 Nexenta Systems, Inc. All rights reserved.
*/ */
/* /*
@ -3173,6 +3173,8 @@ top:
vdev_t *vd = NULL; vdev_t *vd = NULL;
uint64_t addr = 0; uint64_t addr = 0;
boolean_t devw = B_FALSE; boolean_t devw = B_FALSE;
enum zio_compress b_compress = ZIO_COMPRESS_OFF;
uint64_t b_asize = 0;
if (hdr == NULL) { if (hdr == NULL) {
/* this block is not in the cache */ /* this block is not in the cache */
@ -3242,10 +3244,12 @@ top:
hdr->b_acb = acb; hdr->b_acb = acb;
hdr->b_flags |= ARC_IO_IN_PROGRESS; hdr->b_flags |= ARC_IO_IN_PROGRESS;
if (HDR_L2CACHE(hdr) && hdr->b_l2hdr != NULL && if (hdr->b_l2hdr != NULL &&
(vd = hdr->b_l2hdr->b_dev->l2ad_vdev) != NULL) { (vd = hdr->b_l2hdr->b_dev->l2ad_vdev) != NULL) {
devw = hdr->b_l2hdr->b_dev->l2ad_writing; devw = hdr->b_l2hdr->b_dev->l2ad_writing;
addr = hdr->b_l2hdr->b_daddr; addr = hdr->b_l2hdr->b_daddr;
b_compress = hdr->b_l2hdr->b_compress;
b_asize = hdr->b_l2hdr->b_asize;
/* /*
* Lock out device removal. * Lock out device removal.
*/ */
@ -3296,7 +3300,7 @@ top:
cb->l2rcb_bp = *bp; cb->l2rcb_bp = *bp;
cb->l2rcb_zb = *zb; cb->l2rcb_zb = *zb;
cb->l2rcb_flags = zio_flags; cb->l2rcb_flags = zio_flags;
cb->l2rcb_compress = hdr->b_l2hdr->b_compress; cb->l2rcb_compress = b_compress;
ASSERT(addr >= VDEV_LABEL_START_SIZE && ASSERT(addr >= VDEV_LABEL_START_SIZE &&
addr + size < vd->vdev_psize - addr + size < vd->vdev_psize -
@ -3308,8 +3312,7 @@ top:
* Issue a null zio if the underlying buffer * Issue a null zio if the underlying buffer
* was squashed to zero size by compression. * was squashed to zero size by compression.
*/ */
if (hdr->b_l2hdr->b_compress == if (b_compress == ZIO_COMPRESS_EMPTY) {
ZIO_COMPRESS_EMPTY) {
rzio = zio_null(pio, spa, vd, rzio = zio_null(pio, spa, vd,
l2arc_read_done, cb, l2arc_read_done, cb,
zio_flags | ZIO_FLAG_DONT_CACHE | zio_flags | ZIO_FLAG_DONT_CACHE |
@ -3318,8 +3321,8 @@ top:
ZIO_FLAG_DONT_RETRY); ZIO_FLAG_DONT_RETRY);
} else { } else {
rzio = zio_read_phys(pio, vd, addr, rzio = zio_read_phys(pio, vd, addr,
hdr->b_l2hdr->b_asize, b_asize, buf->b_data,
buf->b_data, ZIO_CHECKSUM_OFF, ZIO_CHECKSUM_OFF,
l2arc_read_done, cb, priority, l2arc_read_done, cb, priority,
zio_flags | ZIO_FLAG_DONT_CACHE | zio_flags | ZIO_FLAG_DONT_CACHE |
ZIO_FLAG_CANFAIL | ZIO_FLAG_CANFAIL |
@ -3328,8 +3331,7 @@ top:
} }
DTRACE_PROBE2(l2arc__read, vdev_t *, vd, DTRACE_PROBE2(l2arc__read, vdev_t *, vd,
zio_t *, rzio); zio_t *, rzio);
ARCSTAT_INCR(arcstat_l2_read_bytes, ARCSTAT_INCR(arcstat_l2_read_bytes, b_asize);
hdr->b_l2hdr->b_asize);
if (*arc_flags & ARC_NOWAIT) { if (*arc_flags & ARC_NOWAIT) {
zio_nowait(rzio); zio_nowait(rzio);