[Bug 198500] [gjournal] sysctl kern.geom.journal.cache.limit 32 bit integer overflow

[bugzilla-noreply at freebsd.org]

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=198500

longwitz at incore.de changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |longwitz at incore.de

--- Comment #1 from longwitz at incore.de ---
The main problem caused by the mixed use of u_int and u_long variables in
g_journal.c is the suspicious value of kern.geom.journal.cache.limit
for machines with more than 8 GB of memory. Therefore I propose the following
patch for this problem for FreeBSD 10.3-STABLE #0 r317782:

--- sys/geom/journal/g_journal.c.orig   2017-05-04 10:02:46.000000000 +0200
+++ sys/geom/journal/g_journal.c        2017-05-05 23:37:57.625783000 +0200
@@ -131,28 +131,28 @@
 SYSCTL_UINT(_kern_geom_journal, OID_AUTO, optimize, CTLFLAG_RW,
     &g_journal_do_optimize, 0, "Try to combine bios on flush and copy");

-static u_int g_journal_cache_used = 0;
-static u_int g_journal_cache_limit = 64 * 1024 * 1024;
-TUNABLE_INT("kern.geom.journal.cache.limit", &g_journal_cache_limit);
+static u_long g_journal_cache_used = 0;
+static u_long g_journal_cache_limit = 64 * 1024 * 1024;
+TUNABLE_ULONG("kern.geom.journal.cache.limit", &g_journal_cache_limit);
 static u_int g_journal_cache_divisor = 2;
 TUNABLE_INT("kern.geom.journal.cache.divisor", &g_journal_cache_divisor);
 static u_int g_journal_cache_switch = 90;
 static u_int g_journal_cache_misses = 0;
 static u_int g_journal_cache_alloc_failures = 0;
-static u_int g_journal_cache_low = 0;
+static u_long g_journal_cache_low = 0;

 static SYSCTL_NODE(_kern_geom_journal, OID_AUTO, cache, CTLFLAG_RW, 0,
     "GEOM_JOURNAL cache");
-SYSCTL_UINT(_kern_geom_journal_cache, OID_AUTO, used, CTLFLAG_RD,
+SYSCTL_ULONG(_kern_geom_journal_cache, OID_AUTO, used, CTLFLAG_RD,
     &g_journal_cache_used, 0, "Number of allocated bytes");
 static int
 g_journal_cache_limit_sysctl(SYSCTL_HANDLER_ARGS)
 {
-       u_int limit;
+       u_long limit;
        int error;

        limit = g_journal_cache_limit;
-       error = sysctl_handle_int(oidp, &limit, 0, req);
+       error = sysctl_handle_long(oidp, &limit, 0, req);
        if (error != 0 || req->newptr == NULL)
                return (error);
        g_journal_cache_limit = limit;
@@ -160,7 +160,7 @@
        return (0);
 }
 SYSCTL_PROC(_kern_geom_journal_cache, OID_AUTO, limit,
-    CTLTYPE_UINT | CTLFLAG_RW, NULL, 0, g_journal_cache_limit_sysctl, "I",
+    CTLTYPE_ULONG | CTLFLAG_RW, NULL, 0, g_journal_cache_limit_sysctl, "LU",
     "Maximum number of allocated bytes");
 SYSCTL_UINT(_kern_geom_journal_cache, OID_AUTO, divisor, CTLFLAG_RDTUN,
     &g_journal_cache_divisor, 0,
@@ -3035,8 +3035,8 @@
                        kproc_exit(0);
                }
                if (error == 0 && g_journal_sync_requested == 0) {
-                       GJ_DEBUG(1, "Out of cache, force switch (used=%u "
-                           "limit=%u).", g_journal_cache_used,
+                       GJ_DEBUG(1, "Out of cache, force switch (used=%jd "
+                           "limit=%jd).", g_journal_cache_used,
                            g_journal_cache_limit);
                }
                GJ_TIMER_START(1, &bt);

-- 
You are receiving this mail because:
You are the assignee for the bug.