[src/netbsd-9]: src/external/cddl/osnet/dist/uts/common/fs/zfs Pull up follow...

[martin <martin%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/ec899e819f73
branches:  netbsd-9
changeset: 963881:ec899e819f73
user:      martin <martin%NetBSD.org@localhost>
date:      Wed May 13 12:41:43 2020 +0000

description:
Pull up following revision(s) (requested by chs in ticket #903):

        external/cddl/osnet/dist/uts/common/fs/zfs/zfs_vnops.c: revision 1.66

fix the handling in putpage of the page containing EOF.

diffstat:

 external/cddl/osnet/dist/uts/common/fs/zfs/zfs_vnops.c |  22 +++++++++++++++++-
 1 files changed, 21 insertions(+), 1 deletions(-)

diffs (34 lines):

diff -r 372ee090edab -r ec899e819f73 external/cddl/osnet/dist/uts/common/fs/zfs/zfs_vnops.c
--- a/external/cddl/osnet/dist/uts/common/fs/zfs/zfs_vnops.c    Wed May 13 12:38:37 2020 +0000
+++ b/external/cddl/osnet/dist/uts/common/fs/zfs/zfs_vnops.c    Wed May 13 12:41:43 2020 +0000
@@ -6049,9 +6049,29 @@
                goto out_unbusy;
        }
 
+       /*
+        * Calculate the length and assert that no whole pages are past EOF.
+        * This check is equivalent to "off + len <= round_page(zp->z_size)",
+        * with gyrations to avoid signed integer overflow.
+        */
+
        off = pp[0]->offset;
        len = count * PAGESIZE;
-       KASSERT(off + len <= round_page(zp->z_size));
+       KASSERT(off <= zp->z_size);
+       KASSERT(len <= round_page(zp->z_size));
+       KASSERT(off <= round_page(zp->z_size) - len);
+
+       /*
+        * If EOF is within the last page, reduce len to avoid writing past
+        * the file size in the ZFS buffer.  Assert that
+        * "off + len <= zp->z_size", again avoiding signed integer overflow.
+        */
+
+       if (len > zp->z_size - off) {
+               len = zp->z_size - off;
+       }
+       KASSERT(len <= zp->z_size);
+       KASSERT(off <= zp->z_size - len);
 
        if (zfs_owner_overquota(zfsvfs, zp, B_FALSE) ||
            zfs_owner_overquota(zfsvfs, zp, B_TRUE)) {