HomeFreeBSD

Fix out-of-bound access in zfs_fillpage

Description

Fix out-of-bound access in zfs_fillpage

The original code will do an out-of-bound access on pl[] during last
iteration.

==================================================================
BUG: KASAN: stack-out-of-bounds in zfs_getpage+0x14c/0x2d0 [zfs]
Read of size 8 by task tmpfile/7850
page:ffffea00017c6dc0 count:0 mapcount:0 mapping: (null) index:0x0
flags: 0xffff8000000000()
page dumped because: kasan: bad access detected
CPU: 3 PID: 7850 Comm: tmpfile Tainted: G OE 4.6.0+ #3

ffff88005f1b7678 0000000006dbe035 ffff88005f1b7508 ffffffff81635618
ffff88005f1b7678 ffff88005f1b75a0 ffff88005f1b7590 ffffffff81313ee8
ffffea0001ae8dd0 ffff88005f1b7670 0000000000000246 0000000041b58ab3

Call Trace:

[<ffffffff81635618>] dump_stack+0x63/0x8b
[<ffffffff81313ee8>] kasan_report_error+0x528/0x560
[<ffffffff81278f20>] ? filemap_map_pages+0x5f0/0x5f0
[<ffffffff813144b8>] kasan_report+0x58/0x60
[<ffffffffc12250dc>] ? zfs_getpage+0x14c/0x2d0 [zfs]
[<ffffffff81312e4e>] __asan_load8+0x5e/0x70
[<ffffffffc12250dc>] zfs_getpage+0x14c/0x2d0 [zfs]
[<ffffffffc1252131>] zpl_readpage+0xd1/0x180 [zfs]

[<ffffffff81353c3a>] SyS_execve+0x3a/0x50
[<ffffffff810058ef>] do_syscall_64+0xef/0x180
[<ffffffff81d0ee25>] entry_SYSCALL64_slow_path+0x25/0x25

Memory state around the buggy address:

ffff88005f1b7500: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ffff88005f1b7580: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

>ffff88005f1b7600: 00 00 00 00 00 00 00 00 00 00 f1 f1 f1 f1 00 f4

                                                               ^
ffff88005f1b7680: f4 f4 f3 f3 f3 f3 00 00 00 00 00 00 00 00 00 00
ffff88005f1b7700: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

==================================================================

Signed-off-by: Chunwei Chen <david.chen@osnexus.com>
Signed-off-by: Tony Hutter <hutter2@llnl.gov>
Signed-off-by: Brian Behlendorf <behlendorf1@llnl.gov>
Closes #4705
Issue #4708

Details

Provenance
Chunwei Chen <david.chen@osnexus.com>Authored on May 27 2016, 10:39 PM
Brian Behlendorf <behlendorf1@llnl.gov>Committed on May 31 2016, 11:01 PM
Parents
rG2493dca54e18: Add isa_defs for MIPS
Branches
Unknown
Tags
Unknown

Event Timeline

Brian Behlendorf <behlendorf1@llnl.gov> committed rG540c39279322: Fix out-of-bound access in zfs_fillpage (authored by Chunwei Chen <david.chen@osnexus.com>).May 31 2016, 11:01 PM