From becc212aca9379adb0e6b50184aba8f9dd164795 Mon Sep 17 00:00:00 2001 From: kib Date: Tue, 23 Aug 2016 07:51:00 +0000 Subject: [PATCH] MFC r304227: In ffs_balloc_ufs{1,2} routines, assert that unwind records do not overflow local arrays. git-svn-id: svn://svn.freebsd.org/base/stable/10@304667 ccf9f872-aa2e-dd11-9fc8-001c23d0bc1f --- sys/ufs/ffs/ffs_balloc.c | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/sys/ufs/ffs/ffs_balloc.c b/sys/ufs/ffs/ffs_balloc.c index 8551085b5..b78a7caed 100644 --- a/sys/ufs/ffs/ffs_balloc.c +++ b/sys/ufs/ffs/ffs_balloc.c @@ -255,6 +255,8 @@ ffs_balloc_ufs1(struct vnode *vp, off_t startoffset, int size, } pref = newb + fs->fs_frag; nb = newb; + MPASS(allocblk < allociblk + nitems(allociblk)); + MPASS(lbns_remfree < lbns + nitems(lbns)); *allocblk++ = nb; *lbns_remfree++ = indirs[1].in_lbn; bp = getblk(vp, indirs[1].in_lbn, fs->fs_bsize, 0, 0, gbflags); @@ -325,6 +327,8 @@ ffs_balloc_ufs1(struct vnode *vp, off_t startoffset, int size, } pref = newb + fs->fs_frag; nb = newb; + MPASS(allocblk < allociblk + nitems(allociblk)); + MPASS(lbns_remfree < lbns + nitems(lbns)); *allocblk++ = nb; *lbns_remfree++ = indirs[i].in_lbn; nbp = getblk(vp, indirs[i].in_lbn, fs->fs_bsize, 0, 0, 0); @@ -401,6 +405,8 @@ ffs_balloc_ufs1(struct vnode *vp, off_t startoffset, int size, goto fail; } nb = newb; + MPASS(allocblk < allociblk + nitems(allociblk)); + MPASS(lbns_remfree < lbns + nitems(lbns)); *allocblk++ = nb; *lbns_remfree++ = lbn; nbp = getblk(vp, lbn, fs->fs_bsize, 0, 0, gbflags); @@ -818,6 +824,8 @@ ffs_balloc_ufs2(struct vnode *vp, off_t startoffset, int size, } pref = newb + fs->fs_frag; nb = newb; + MPASS(allocblk < allociblk + nitems(allociblk)); + MPASS(lbns_remfree < lbns + nitems(lbns)); *allocblk++ = nb; *lbns_remfree++ = indirs[1].in_lbn; bp = getblk(vp, indirs[1].in_lbn, fs->fs_bsize, 0, 0, @@ -889,6 +897,8 @@ ffs_balloc_ufs2(struct vnode *vp, off_t startoffset, int size, } pref = newb + fs->fs_frag; nb = newb; + MPASS(allocblk < allociblk + nitems(allociblk)); + MPASS(lbns_remfree < lbns + nitems(lbns)); *allocblk++ = nb; *lbns_remfree++ = indirs[i].in_lbn; nbp = getblk(vp, indirs[i].in_lbn, fs->fs_bsize, 0, 0, @@ -966,6 +976,8 @@ ffs_balloc_ufs2(struct vnode *vp, off_t startoffset, int size, goto fail; } nb = newb; + MPASS(allocblk < allociblk + nitems(allociblk)); + MPASS(lbns_remfree < lbns + nitems(lbns)); *allocblk++ = nb; *lbns_remfree++ = lbn; nbp = getblk(vp, lbn, fs->fs_bsize, 0, 0, gbflags); -- 2.45.0