Archive-Team
/
zfs
2
0
Fork 0
Code Issues Pull Requests Packages Projects Releases 103 Wiki Activity

zdb: zdb_ddt_leak_init() reads uninitialized memory when birth == 0 

This was written by Jeff Bonick and was committed to OpenSolaris on
November 1, 2009. It appears that Jeff meant to continue the outer loop
iteration when `ddp->ddp_phys_birth == 0`, but put his check inside the
inner loop. This causes a pointer to uninitialized memory to be passed
to ddt_lookup() inside a VERIFY() statement whenever that condition is
true.

Reported-by: Coverity (CID 1524462)
Reviewed-by: Damian Szuberski <szuberskidamian@gmail.com>
Reviewed-by: Alexander Motin <mav@FreeBSD.org>
Reviewed-by: Brian Behlendorf <behlendorf1@llnl.gov>
Signed-off-by: Richard Yao <richard.yao@alumni.stonybrook.edu>
Closes #14264
This commit is contained in:
Richard Yao 2022-12-03 15:09:48 -05:00 committed by Brian Behlendorf
parent 2709ace096
commit d30db519af
1 changed files with 3 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
cmd/zdb/zdb.c
View File

@ -5779,9 +5779,10 @@ zdb_ddt_leak_init(spa_t *spa, zdb_cb_t *zcb)
ASSERT(ddt_phys_total_refcnt(&dde) > 1); ASSERT(ddt_phys_total_refcnt(&dde) > 1);
if (ddp->ddp_phys_birth == 0)
continue;
for (p = 0; p < DDT_PHYS_TYPES; p++, ddp++) { for (p = 0; p < DDT_PHYS_TYPES; p++, ddp++) {
if (ddp->ddp_phys_birth == 0)
continue;
ddt_bp_create(ddb.ddb_checksum, ddt_bp_create(ddb.ddb_checksum,
&dde.dde_key, ddp, &blk); &dde.dde_key, ddp, &blk);
if (p == DDT_PHYS_DITTO) { if (p == DDT_PHYS_DITTO) {