From nobody Tue Oct 12 08:23:36 2021 X-Original-To: bugs@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 26AEC17EE9E0 for ; Tue, 12 Oct 2021 08:23:36 +0000 (UTC) (envelope-from bugzilla-noreply@freebsd.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4HT7wS0XH9z3HPT for ; Tue, 12 Oct 2021 08:23:36 +0000 (UTC) (envelope-from bugzilla-noreply@freebsd.org) Received: from kenobi.freebsd.org (kenobi.freebsd.org [IPv6:2610:1c1:1:606c::50:1d]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id E7F5911704 for ; Tue, 12 Oct 2021 08:23:35 +0000 (UTC) (envelope-from bugzilla-noreply@freebsd.org) Received: from kenobi.freebsd.org ([127.0.1.5]) by kenobi.freebsd.org (8.15.2/8.15.2) with ESMTP id 19C8NZC9025117 for ; Tue, 12 Oct 2021 08:23:35 GMT (envelope-from bugzilla-noreply@freebsd.org) Received: (from www@localhost) by kenobi.freebsd.org (8.15.2/8.15.2/Submit) id 19C8NZsS025116 for bugs@FreeBSD.org; Tue, 12 Oct 2021 08:23:35 GMT (envelope-from bugzilla-noreply@freebsd.org) X-Authentication-Warning: kenobi.freebsd.org: www set sender to bugzilla-noreply@freebsd.org using -f From: bugzilla-noreply@freebsd.org To: bugs@FreeBSD.org Subject: [Bug 259093] [zfs] [panic] NULL pointer dereference on "zfs send --raw" of encrypted filesystem. Date: Tue, 12 Oct 2021 08:23:36 +0000 X-Bugzilla-Reason: AssignedTo X-Bugzilla-Type: new X-Bugzilla-Watch-Reason: None X-Bugzilla-Product: Base System X-Bugzilla-Component: kern X-Bugzilla-Version: 13.0-STABLE X-Bugzilla-Keywords: X-Bugzilla-Severity: Affects Only Me X-Bugzilla-Who: peterj@FreeBSD.org X-Bugzilla-Status: New X-Bugzilla-Resolution: X-Bugzilla-Priority: --- X-Bugzilla-Assigned-To: bugs@FreeBSD.org X-Bugzilla-Flags: X-Bugzilla-Changed-Fields: bug_id short_desc product version rep_platform op_sys bug_status bug_severity priority component assigned_to reporter Message-ID: Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable X-Bugzilla-URL: https://bugs.freebsd.org/bugzilla/ Auto-Submitted: auto-generated List-Id: Bug reports List-Archive: https://lists.freebsd.org/archives/freebsd-bugs List-Help: List-Post: List-Subscribe: List-Unsubscribe: Sender: owner-freebsd-bugs@freebsd.org MIME-Version: 1.0 X-ThisMailContainsUnwantedMimeParts: N https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=3D259093 Bug ID: 259093 Summary: [zfs] [panic] NULL pointer dereference on "zfs send --raw" of encrypted filesystem. Product: Base System Version: 13.0-STABLE Hardware: Any OS: Any Status: New Severity: Affects Only Me Priority: --- Component: kern Assignee: bugs@FreeBSD.org Reporter: peterj@FreeBSD.org I'm running 13-stable fdbbd118faab but the code is identical in HEAD. Looking at the backtrace: #16 #17 dmu_dump_write (dscp=3Ddscp@entry=3D0xfffffe02501abc30, type=3D, object=3D, offset=3D, offset@entry=3D0, lsize=3D, lsize@entry=3D131072, psize=3Dpsize@entry=3D13= 1072, bp=3D0x0, data=3D0xfffffe02d94a6000) at /usr/src/sys/contrib/openzfs/module/zfs/dmu_send.c:493 #18 0xffffffff80410a3c in do_dump (dscp=3Ddscp@entry=3D0xfffffe02501abc30, range=3Drange@entry=3D0xfffff805fd82d900) at /usr/src/sys/contrib/openzfs/module/zfs/dmu_send.c:1016 #19 0xffffffff8040ead3 in dmu_send_impl (dspp=3D, dspp@entry=3D0xfffffe02501abdf0) at /usr/src/sys/contrib/openzfs/module/zfs/dmu_send.c:2537 #20 0xffffffff8040d8fd in dmu_send_obj (pool=3D, pool@entry=3D0xfffffe02d3b61000 "tank/compat@20210604bu", tosnap=3D1069= 0, fromsnap=3D11065, embedok=3D, embedok@entry=3D1, large_block_ok=3D, large_block_ok@entry=3D2, compressok=3D, compressok@entry=3D4, rawok=3D8, savedok= =3D0, outfd=3D1, off=3D0xfffffe02501ac070, dsop=3D0xfffffe02501ac058) at /usr/src/sys/contrib/openzfs/module/zfs/dmu_send.c:2695 dmu_send.c:493 is "ASSERT(!BP_IS_EMBEDDED(bp));" which dereferences bp with no checks for NULL, whereas dmu_send.c:1016 explicitly passes NULL to dmu_dump_write() as bp. This is obviously a bug somewhere. Looking at the comment at lines 1006-1008, it seems the code expects that raw sends will always have large block sends enabled, avoiding the problematic code block. And zfs-send(8) says that --raw implies --large-block if the source is not encrypted. But even if I explicitly specify --large-block then the code panics in the same way. (And --large-block as on option doesn't actually make sense with --raw because the send stream must match what's on local disk by definition). --=20 You are receiving this mail because: You are the assignee for the bug.=