[PATCH FOR REVIEW] Extended attribute

Xin LI delphij at delphij.net
Fri Oct 14 22:21:44 UTC 2011


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Hi,

I think we hit a bug in sa_find_sizes:

 - hdrsize grows by 4 bytes each time;
 - On return, hdrsize is rounded up to nearest 8 byte boundary;
 - On the other hand, when testing for whether spill is needed, the
code uses sum of (*total + hdrsize) and rounds that number up to
nearest 8 byte boundary.

This causes a problem when *total==306 and hdrsize==12.  We have:

	(306 + 12) = 318
	ROUNDUP(318, 8) = 320

On return, we have:

	total = 306
	hdrsize = 16

And spill is unset.  This would lead to a panic.

Comments?

Cheers,
- -- 
Xin LI <delphij at delphij.net>	https://www.delphij.net/
FreeBSD - The Power to Serve!		Live free or die
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.18 (FreeBSD)

iQEcBAEBCAAGBQJOmLXyAAoJEATO+BI/yjfBlikH+wQCt9BFDyFtH7CAaCui8W4b
MnGo1Ocpbgzx0UBVcJkb5pglqscEihDMfQXLQHzbf+v0Bu3nfH2MudNsdr4/Ig2X
XUD6cBD1cAN1x5jWzBIKrS7nigxICfd+cOsZ2J1vRj0Qu6TJ9t3kAETuZsU6l4Ee
3KfvoTu48E/2CzeCD4aAbqJH6bbIJ26dKRQ+KTp+FTLLk8goqDCQ7RgbEfO1QYZm
vV+Ee+olvHDddC0Oxe08/X8seWaZg/N2ZZNT1Umo8VeiRvbKlUEs1hj8KN2ddDtD
7ufTbEuSgQVMRvZT/9aCpEl4/g7o5yIKUFWyJuXViSxT/n9hk1a1rdRaWun6Ges=
=nprr
-----END PGP SIGNATURE-----
-------------- next part --------------
Index: sys/cddl/contrib/opensolaris/uts/common/fs/zfs/sa.c
===================================================================
--- sys/cddl/contrib/opensolaris/uts/common/fs/zfs/sa.c	(revision 226366)
+++ sys/cddl/contrib/opensolaris/uts/common/fs/zfs/sa.c	(working copy)
@@ -605,14 +605,14 @@ sa_find_sizes(sa_os_t *sa, sa_bulk_attr_t *attr_de
 		 * and spill buffer.
 		 */
 		if (buftype == SA_BONUS && *index == -1 &&
-		    P2ROUNDUP(*total + hdrsize, 8) >
+		    (*total + P2ROUNDUP(hdrsize, 8)) >
 		    (full_space - sizeof (blkptr_t))) {
 			*index = i;
 			done = B_TRUE;
 		}
 
 next:
-		if (P2ROUNDUP(*total + hdrsize, 8) > full_space &&
+		if ((*total + P2ROUNDUP(hdrsize, 8)) > full_space &&
 		    buftype == SA_BONUS)
 			*will_spill = B_TRUE;
 	}


More information about the zfs-devel mailing list