Mon Mar 9 15:37:46 2020 UTC ()
external/cddl/osnet: Fix possible signed integer overflow

Detected by UBSan and fixed upstream

Cherry-pick:
From 05852b3467b44cdf88541ec67624cd1f5f2ded1d Mon Sep 17 00:00:00 2001
From: luozhengzheng <luo.zhengzheng@zte.com.cn>
Date: Fri, 14 Oct 2016 05:25:05 +0800
Subject: [PATCH] Fix coverity defects: CID 147571, 147574

CID 147571: Unintentional integer overflow (OVERFLOW_BEFORE_WIDEN)
CID 147574: Unintentional integer overflow (OVERFLOW_BEFORE_WIDEN)

Reviewed-by: Brian Behlendorf <behlendorf1@llnl.gov>
Signed-off-by: luozhengzheng <luo.zhengzheng@zte.com.cn>
Closes #5268

Reviewed by: kamil@


(fox)
diff -r1.4 -r1.5 src/external/cddl/osnet/dist/uts/common/fs/zfs/dmu_tx.c
diff -r1.10 -r1.11 src/external/cddl/osnet/dist/uts/common/fs/zfs/spa.c
cvs diff -r1.4 -r1.5 src/external/cddl/osnet/dist/uts/common/fs/zfs/dmu_tx.c (expand / switch to unified diff)

--- src/external/cddl/osnet/dist/uts/common/fs/zfs/dmu_tx.c 2019/06/21 10:59:50 1.4
+++ src/external/cddl/osnet/dist/uts/common/fs/zfs/dmu_tx.c 2020/03/09 15:37:46 1.5
@@ -402,27 +402,27 @@ out: @@ -402,27 +402,27 @@ out:
402 2 * DMU_MAX_ACCESS) 402 2 * DMU_MAX_ACCESS)
403 err = SET_ERROR(EFBIG); 403 err = SET_ERROR(EFBIG);
404 404
405 if (err) 405 if (err)
406 txh->txh_tx->tx_err = err; 406 txh->txh_tx->tx_err = err;
407} 407}
408 408
409static void 409static void
410dmu_tx_count_dnode(dmu_tx_hold_t *txh) 410dmu_tx_count_dnode(dmu_tx_hold_t *txh)
411{ 411{
412 dnode_t *dn = txh->txh_dnode; 412 dnode_t *dn = txh->txh_dnode;
413 dnode_t *mdn = DMU_META_DNODE(txh->txh_tx->tx_objset); 413 dnode_t *mdn = DMU_META_DNODE(txh->txh_tx->tx_objset);
414 uint64_t space = mdn->dn_datablksz + 414 uint64_t space = mdn->dn_datablksz +
415 ((mdn->dn_nlevels-1) << mdn->dn_indblkshift); 415 ((uint64_t)(mdn->dn_nlevels-1) << mdn->dn_indblkshift);
416 416
417 if (dn && dn->dn_dbuf->db_blkptr && 417 if (dn && dn->dn_dbuf->db_blkptr &&
418 dsl_dataset_block_freeable(dn->dn_objset->os_dsl_dataset, 418 dsl_dataset_block_freeable(dn->dn_objset->os_dsl_dataset,
419 dn->dn_dbuf->db_blkptr, dn->dn_dbuf->db_blkptr->blk_birth)) { 419 dn->dn_dbuf->db_blkptr, dn->dn_dbuf->db_blkptr->blk_birth)) {
420 (void) refcount_add_many(&txh->txh_space_tooverwrite, 420 (void) refcount_add_many(&txh->txh_space_tooverwrite,
421 space, FTAG); 421 space, FTAG);
422 (void) refcount_add_many(&txh->txh_space_tounref, space, FTAG); 422 (void) refcount_add_many(&txh->txh_space_tounref, space, FTAG);
423 } else { 423 } else {
424 (void) refcount_add_many(&txh->txh_space_towrite, space, FTAG); 424 (void) refcount_add_many(&txh->txh_space_towrite, space, FTAG);
425 if (dn && dn->dn_dbuf->db_blkptr) { 425 if (dn && dn->dn_dbuf->db_blkptr) {
426 (void) refcount_add_many(&txh->txh_space_tounref, 426 (void) refcount_add_many(&txh->txh_space_tounref,
427 space, FTAG); 427 space, FTAG);
428 } 428 }
cvs diff -r1.10 -r1.11 src/external/cddl/osnet/dist/uts/common/fs/zfs/spa.c (expand / switch to unified diff)

--- src/external/cddl/osnet/dist/uts/common/fs/zfs/spa.c 2019/07/23 07:46:22 1.10
+++ src/external/cddl/osnet/dist/uts/common/fs/zfs/spa.c 2020/03/09 15:37:46 1.11
@@ -6283,27 +6283,27 @@ spa_async_tasks_pending(spa_t *spa) @@ -6283,27 +6283,27 @@ spa_async_tasks_pending(spa_t *spa)
6283{ 6283{
6284 uint_t non_config_tasks; 6284 uint_t non_config_tasks;
6285 uint_t config_task; 6285 uint_t config_task;
6286 boolean_t config_task_suspended; 6286 boolean_t config_task_suspended;
6287 6287
6288 non_config_tasks = spa->spa_async_tasks & ~(SPA_ASYNC_CONFIG_UPDATE | 6288 non_config_tasks = spa->spa_async_tasks & ~(SPA_ASYNC_CONFIG_UPDATE |
6289 SPA_ASYNC_REMOVE); 6289 SPA_ASYNC_REMOVE);
6290 config_task = spa->spa_async_tasks & SPA_ASYNC_CONFIG_UPDATE; 6290 config_task = spa->spa_async_tasks & SPA_ASYNC_CONFIG_UPDATE;
6291 if (spa->spa_ccw_fail_time == 0) { 6291 if (spa->spa_ccw_fail_time == 0) {
6292 config_task_suspended = B_FALSE; 6292 config_task_suspended = B_FALSE;
6293 } else { 6293 } else {
6294 config_task_suspended = 6294 config_task_suspended =
6295 (gethrtime() - spa->spa_ccw_fail_time) < 6295 (gethrtime() - spa->spa_ccw_fail_time) <
6296 (zfs_ccw_retry_interval * NANOSEC); 6296 ((hrtime_t)zfs_ccw_retry_interval * NANOSEC);
6297 } 6297 }
6298 6298
6299 return (non_config_tasks || (config_task && !config_task_suspended)); 6299 return (non_config_tasks || (config_task && !config_task_suspended));
6300} 6300}
6301 6301
6302static void 6302static void
6303spa_async_dispatch(spa_t *spa) 6303spa_async_dispatch(spa_t *spa)
6304{ 6304{
6305 mutex_enter(&spa->spa_async_lock); 6305 mutex_enter(&spa->spa_async_lock);
6306 if (spa_async_tasks_pending(spa) && 6306 if (spa_async_tasks_pending(spa) &&
6307 !spa->spa_async_suspended && 6307 !spa->spa_async_suspended &&
6308 spa->spa_async_thread == NULL && 6308 spa->spa_async_thread == NULL &&
6309 rootdir != NULL) 6309 rootdir != NULL)