Actions
Bug #6101
closedattempt to lzc_create() a filesystem under a volume results in a panic
Status:
Closed
Priority:
High
Assignee:
-
Category:
zfs - Zettabyte File System
Start date:
2015-08-06
Due date:
% Done:
100%
Estimated time:
Difficulty:
Medium
Tags:
needs-triage
Gerrit CR:
Description
lzc_create()
, or more correctly, zfs_ioc_create()
does not reject an attempt to create a filesystem as a child of a volume, instead it proceeds to a crash.
A crash stack obtained on FreeBSD:
page fault while in kernel mode zap_leaf_lookup() fzap_lookup() zap_lookup_norm() zap_lookup() zfs_get_zplprop() zfs_fill_zplprops_impl() zfs_ioc_create() zfsdev_ioctl() devfs_ioctl_f() kern_ioctl() sys_ioctl()
This crash happened with a kernel without debugging assertions.
The immediate cause of crash appears to an attempt to interpret a zvol object as a zap object.
For filesystems:
#define MASTER_NODE_OBJ 1
For zvols:
#define ZVOL_OBJ 1ULL #define ZVOL_ZAP_OBJ 2ULLSo, I see two problems here:
- an attempt to create a filesystem under a zvol should be rejected as early as possible, maybe in
zfs_fill_zplprops()
- maybe
zap_lookup
/zap_lockdir
should reject objects that are not of one of the zap object types
Updated by Andriy Gapon about 5 years ago
Updated by Electric Monk about 5 years ago
- Status changed from New to Closed
- % Done changed from 0 to 100
git commit b127fe3c059af7adf772735498680b4f2e1405ef
commit b127fe3c059af7adf772735498680b4f2e1405ef Author: Andriy Gapon <avg@FreeBSD.org> Date: 2017-04-14T03:50:37.000Z 6101 attempt to lzc_create() a filesystem under a volume results in a panic Reviewed by: Matthew Ahrens <mahrens@delphix.com> Approved by: Dan McDonald <danmcd@omniti.com>
Actions