Project

General

Profile

Bug #6101

attempt to lzc_create() a filesystem under a volume results in a panic

Added by Andriy Gapon almost 5 years ago. Updated about 3 years ago.

Status:
Closed
Priority:
High
Assignee:
-
Category:
zfs - Zettabyte File System
Start date:
2015-08-06
Due date:
% Done:

100%

Estimated time:
Difficulty:
Medium
Tags:
needs-triage
Gerrit CR:

Description

lzc_create(), or more correctly, zfs_ioc_create() does not reject an attempt to create a filesystem as a child of a volume, instead it proceeds to a crash.
A crash stack obtained on FreeBSD:

page fault while in kernel mode

zap_leaf_lookup()
fzap_lookup()
zap_lookup_norm()
zap_lookup()
zfs_get_zplprop()
zfs_fill_zplprops_impl()
zfs_ioc_create()
zfsdev_ioctl()
devfs_ioctl_f()
kern_ioctl()
sys_ioctl()

This crash happened with a kernel without debugging assertions.
The immediate cause of crash appears to an attempt to interpret a zvol object as a zap object.

For filesystems:

#define MASTER_NODE_OBJ 1

For zvols:

#define ZVOL_OBJ                1ULL
#define ZVOL_ZAP_OBJ            2ULL

So, I see two problems here:
  1. an attempt to create a filesystem under a zvol should be rejected as early as possible, maybe in zfs_fill_zplprops()
  2. maybe zap_lookup / zap_lockdir should reject objects that are not of one of the zap object types

History

#2

Updated by Electric Monk about 3 years ago

  • Status changed from New to Closed
  • % Done changed from 0 to 100

git commit b127fe3c059af7adf772735498680b4f2e1405ef

commit  b127fe3c059af7adf772735498680b4f2e1405ef
Author: Andriy Gapon <avg@FreeBSD.org>
Date:   2017-04-14T03:50:37.000Z

    6101 attempt to lzc_create() a filesystem under a volume results in a panic
    Reviewed by: Matthew Ahrens <mahrens@delphix.com>
    Approved by: Dan McDonald <danmcd@omniti.com>

Also available in: Atom PDF