svn commit: r314029 - stable/10/sys/cddl/contrib/opensolaris/uts/common/fs/zfs

[Andriy Gapon]

Author: avg
Date: Tue Feb 21 08:57:27 2017
New Revision: 314029
URL: https://svnweb.freebsd.org/changeset/base/314029

Log:
  MFC r313686: check remaining space in zfs implementations of vptocnp
  
  PR:		216939

Modified:
  stable/10/sys/cddl/contrib/opensolaris/uts/common/fs/zfs/zfs_ctldir.c
  stable/10/sys/cddl/contrib/opensolaris/uts/common/fs/zfs/zfs_vnops.c
Directory Properties:
  stable/10/   (props changed)

Modified: stable/10/sys/cddl/contrib/opensolaris/uts/common/fs/zfs/zfs_ctldir.c
==============================================================================
--- stable/10/sys/cddl/contrib/opensolaris/uts/common/fs/zfs/zfs_ctldir.c	Tue Feb 21 07:02:51 2017	(r314028)
+++ stable/10/sys/cddl/contrib/opensolaris/uts/common/fs/zfs/zfs_ctldir.c	Tue Feb 21 08:57:27 2017	(r314029)
@@ -1604,16 +1604,21 @@ zfsctl_snapshot_vptocnp(struct vop_vptoc
 	}
 	if (sep == NULL) {
 		mutex_exit(&sdp->sd_lock);
-		error = ENOENT;
+		error = SET_ERROR(ENOENT);
 	} else {
 		size_t len;
 
 		len = strlen(sep->se_name);
-		*ap->a_buflen -= len;
-		bcopy(sep->se_name, ap->a_buf + *ap->a_buflen, len);
-		mutex_exit(&sdp->sd_lock);
-		vref(dvp);
-		*ap->a_vpp = dvp;
+		if (*ap->a_buflen < len) {
+			mutex_exit(&sdp->sd_lock);
+			error = SET_ERROR(ENOMEM);
+		} else {
+			*ap->a_buflen -= len;
+			bcopy(sep->se_name, ap->a_buf + *ap->a_buflen, len);
+			mutex_exit(&sdp->sd_lock);
+			vref(dvp);
+			*ap->a_vpp = dvp;
+		}
 	}
 	VN_RELE(dvp);
 

Modified: stable/10/sys/cddl/contrib/opensolaris/uts/common/fs/zfs/zfs_vnops.c
==============================================================================
--- stable/10/sys/cddl/contrib/opensolaris/uts/common/fs/zfs/zfs_vnops.c	Tue Feb 21 07:02:51 2017	(r314028)
+++ stable/10/sys/cddl/contrib/opensolaris/uts/common/fs/zfs/zfs_vnops.c	Tue Feb 21 08:57:27 2017	(r314029)
@@ -5984,6 +5984,10 @@ zfs_vptocnp(struct vop_vptocnp_args *ap)
 		error = zfs_znode_parent_and_name(zp, &dzp, name);
 		if (error == 0) {
 			len = strlen(name);
+			if (*ap->a_buflen < len)
+				error = SET_ERROR(ENOMEM);
+		}
+		if (error == 0) {
 			*ap->a_buflen -= len;
 			bcopy(name, ap->a_buf + *ap->a_buflen, len);
 			*ap->a_vpp = ZTOV(dzp);