mirror of
https://github.com/freebsd/freebsd-src
synced 2024-10-18 22:33:39 +00:00
Fix out of bounds write causing random panics,
uncovered by the change in r230256 Reviewed by: pluknet@ MFC after: 3 days
This commit is contained in:
parent
2121d8a585
commit
3ce26884ba
Notes:
svn2git
2020-12-20 02:59:44 +00:00
svn path=/head/; revision=230913
|
@ -993,7 +993,7 @@ dnode_buf_pageout(dmu_buf_t *db, void *arg)
|
|||
dnh->dnh_dnode = NULL;
|
||||
}
|
||||
kmem_free(children_dnodes, sizeof (dnode_children_t) +
|
||||
(epb - 1) * sizeof (dnode_handle_t));
|
||||
epb * sizeof (dnode_handle_t));
|
||||
}
|
||||
|
||||
/*
|
||||
|
@ -1078,7 +1078,7 @@ dnode_hold_impl(objset_t *os, uint64_t object, int flag,
|
|||
int i;
|
||||
dnode_children_t *winner;
|
||||
children_dnodes = kmem_zalloc(sizeof (dnode_children_t) +
|
||||
(epb - 1) * sizeof (dnode_handle_t), KM_SLEEP);
|
||||
epb * sizeof (dnode_handle_t), KM_SLEEP);
|
||||
children_dnodes->dnc_count = epb;
|
||||
dnh = &children_dnodes->dnc_children[0];
|
||||
for (i = 0; i < epb; i++) {
|
||||
|
@ -1088,7 +1088,7 @@ dnode_hold_impl(objset_t *os, uint64_t object, int flag,
|
|||
if (winner = dmu_buf_set_user(&db->db, children_dnodes, NULL,
|
||||
dnode_buf_pageout)) {
|
||||
kmem_free(children_dnodes, sizeof (dnode_children_t) +
|
||||
(epb - 1) * sizeof (dnode_handle_t));
|
||||
epb * sizeof (dnode_handle_t));
|
||||
children_dnodes = winner;
|
||||
}
|
||||
}
|
||||
|
|
Loading…
Reference in a new issue