Author: avg
Date: Tue Jul 12 12:01:54 2016
New Revision: 302660
URL: https://svnweb.freebsd.org/changeset/base/302660

Log:
  6314 buffer overflow in dsl_dataset_name
  
  illumos/illumos-gate@9adfa60d484ce2435f5af77cc99dcd4e692b6660
  
https://github.com/illumos/illumos-gate/commit/9adfa60d484ce2435f5af77cc99dcd4e692b6660
  
  https://www.illumos.org/issues/6314
    Callers of dsl_dataset_name pass a buffer of size ZFS_MAXNAMELEN, but
    dsl_dataset_name copies the datasets' name PLUS the snapshot name to it,
    resulting in a max of 2 * ZFS_MAXNAMELEN + '@'.
  
  Reviewed by: George Wilson <george.wil...@delphix.com>
  Reviewed by: Prakash Surya <prakash.su...@delphix.com>
  Reviewed by: Igor Kozhukhov <ikozhuk...@gmail.com>
  Approved by: Dan McDonald <dan...@omniti.com>
  Author: Matthew Ahrens <mahr...@delphix.com>

Modified:
  vendor-sys/illumos/dist/common/zfs/zfs_namecheck.c
  vendor-sys/illumos/dist/uts/common/fs/zfs/dmu_objset.c
  vendor-sys/illumos/dist/uts/common/fs/zfs/dmu_send.c
  vendor-sys/illumos/dist/uts/common/fs/zfs/dsl_bookmark.c
  vendor-sys/illumos/dist/uts/common/fs/zfs/dsl_dataset.c
  vendor-sys/illumos/dist/uts/common/fs/zfs/dsl_deleg.c
  vendor-sys/illumos/dist/uts/common/fs/zfs/dsl_dir.c
  vendor-sys/illumos/dist/uts/common/fs/zfs/dsl_prop.c
  vendor-sys/illumos/dist/uts/common/fs/zfs/dsl_scan.c
  vendor-sys/illumos/dist/uts/common/fs/zfs/dsl_userhold.c
  vendor-sys/illumos/dist/uts/common/fs/zfs/spa.c
  vendor-sys/illumos/dist/uts/common/fs/zfs/spa_history.c
  vendor-sys/illumos/dist/uts/common/fs/zfs/sys/dmu.h
  vendor-sys/illumos/dist/uts/common/fs/zfs/sys/dsl_dataset.h
  vendor-sys/illumos/dist/uts/common/fs/zfs/sys/dsl_dir.h
  vendor-sys/illumos/dist/uts/common/fs/zfs/sys/spa_impl.h
  vendor-sys/illumos/dist/uts/common/fs/zfs/sys/zap.h
  vendor-sys/illumos/dist/uts/common/fs/zfs/sys/zfs_znode.h
  vendor-sys/illumos/dist/uts/common/fs/zfs/zfs_ctldir.c
  vendor-sys/illumos/dist/uts/common/fs/zfs/zfs_ioctl.c
  vendor-sys/illumos/dist/uts/common/fs/zfs/zfs_vfsops.c
  vendor-sys/illumos/dist/uts/common/fs/zfs/zil.c
  vendor-sys/illumos/dist/uts/common/sys/fs/zfs.h

Changes in other areas also in this revision:
Modified:
  vendor/illumos/dist/cmd/zdb/zdb.c
  vendor/illumos/dist/cmd/zfs/zfs_main.c
  vendor/illumos/dist/cmd/zhack/zhack.c
  vendor/illumos/dist/cmd/ztest/ztest.c
  vendor/illumos/dist/lib/libzfs/common/libzfs.h
  vendor/illumos/dist/lib/libzfs/common/libzfs_changelist.c
  vendor/illumos/dist/lib/libzfs/common/libzfs_dataset.c
  vendor/illumos/dist/lib/libzfs/common/libzfs_diff.c
  vendor/illumos/dist/lib/libzfs/common/libzfs_impl.h
  vendor/illumos/dist/lib/libzfs/common/libzfs_iter.c
  vendor/illumos/dist/lib/libzfs/common/libzfs_mount.c
  vendor/illumos/dist/lib/libzfs/common/libzfs_pool.c
  vendor/illumos/dist/lib/libzfs/common/libzfs_sendrecv.c
  vendor/illumos/dist/lib/libzfs_core/common/libzfs_core.c

Modified: vendor-sys/illumos/dist/common/zfs/zfs_namecheck.c
==============================================================================
--- vendor-sys/illumos/dist/common/zfs/zfs_namecheck.c  Tue Jul 12 12:00:31 
2016        (r302659)
+++ vendor-sys/illumos/dist/common/zfs/zfs_namecheck.c  Tue Jul 12 12:01:54 
2016        (r302660)
@@ -69,7 +69,7 @@ zfs_component_namecheck(const char *path
 {
        const char *loc;
 
-       if (strlen(path) >= MAXNAMELEN) {
+       if (strlen(path) >= ZFS_MAX_DATASET_NAME_LEN) {
                if (why)
                        *why = NAME_ERR_TOOLONG;
                return (-1);
@@ -140,14 +140,9 @@ dataset_namecheck(const char *path, name
 
        /*
         * Make sure the name is not too long.
-        *
-        * ZFS_MAXNAMELEN is the maximum dataset length used in the userland
-        * which is the same as MAXNAMELEN used in the kernel.
-        * If ZFS_MAXNAMELEN value is changed, make sure to cleanup all
-        * places using MAXNAMELEN.
         */
 
-       if (strlen(path) >= MAXNAMELEN) {
+       if (strlen(path) >= ZFS_MAX_DATASET_NAME_LEN) {
                if (why)
                        *why = NAME_ERR_TOOLONG;
                return (-1);
@@ -276,7 +271,7 @@ mountpoint_namecheck(const char *path, n
                while (*end != '/' && *end != '\0')
                        end++;
 
-               if (end - start >= MAXNAMELEN) {
+               if (end - start >= ZFS_MAX_DATASET_NAME_LEN) {
                        if (why)
                                *why = NAME_ERR_TOOLONG;
                        return (-1);
@@ -301,13 +296,8 @@ pool_namecheck(const char *pool, nameche
 
        /*
         * Make sure the name is not too long.
-        *
-        * ZPOOL_MAXNAMELEN is the maximum pool length used in the userland
-        * which is the same as MAXNAMELEN used in the kernel.
-        * If ZPOOL_MAXNAMELEN value is changed, make sure to cleanup all
-        * places using MAXNAMELEN.
         */
-       if (strlen(pool) >= MAXNAMELEN) {
+       if (strlen(pool) >= ZFS_MAX_DATASET_NAME_LEN) {
                if (why)
                        *why = NAME_ERR_TOOLONG;
                return (-1);

Modified: vendor-sys/illumos/dist/uts/common/fs/zfs/dmu_objset.c
==============================================================================
--- vendor-sys/illumos/dist/uts/common/fs/zfs/dmu_objset.c      Tue Jul 12 
12:00:31 2016        (r302659)
+++ vendor-sys/illumos/dist/uts/common/fs/zfs/dmu_objset.c      Tue Jul 12 
12:01:54 2016        (r302660)
@@ -621,7 +621,7 @@ dmu_objset_refresh_ownership(objset_t *o
 {
        dsl_pool_t *dp;
        dsl_dataset_t *ds, *newds;
-       char name[MAXNAMELEN];
+       char name[ZFS_MAX_DATASET_NAME_LEN];
 
        ds = os->os_dsl_dataset;
        VERIFY3P(ds, !=, NULL);
@@ -839,6 +839,9 @@ dmu_objset_create_check(void *arg, dmu_t
        if (strchr(doca->doca_name, '@') != NULL)
                return (SET_ERROR(EINVAL));
 
+       if (strlen(doca->doca_name) >= ZFS_MAX_DATASET_NAME_LEN)
+               return (SET_ERROR(ENAMETOOLONG));
+
        error = dsl_dir_hold(dp, doca->doca_name, FTAG, &pdd, &tail);
        if (error != 0)
                return (error);
@@ -923,6 +926,9 @@ dmu_objset_clone_check(void *arg, dmu_tx
        if (strchr(doca->doca_clone, '@') != NULL)
                return (SET_ERROR(EINVAL));
 
+       if (strlen(doca->doca_clone) >= ZFS_MAX_DATASET_NAME_LEN)
+               return (SET_ERROR(ENAMETOOLONG));
+
        error = dsl_dir_hold(dp, doca->doca_clone, FTAG, &pdd, &tail);
        if (error != 0)
                return (error);
@@ -962,7 +968,7 @@ dmu_objset_clone_sync(void *arg, dmu_tx_
        const char *tail;
        dsl_dataset_t *origin, *ds;
        uint64_t obj;
-       char namebuf[MAXNAMELEN];
+       char namebuf[ZFS_MAX_DATASET_NAME_LEN];
 
        VERIFY0(dsl_dir_hold(dp, doca->doca_clone, FTAG, &pdd, &tail));
        VERIFY0(dsl_dataset_hold(dp, doca->doca_origin, FTAG, &origin));
@@ -1973,7 +1979,7 @@ dmu_objset_get_user(objset_t *os)
 
 /*
  * Determine name of filesystem, given name of snapshot.
- * buf must be at least MAXNAMELEN bytes
+ * buf must be at least ZFS_MAX_DATASET_NAME_LEN bytes
  */
 int
 dmu_fsname(const char *snapname, char *buf)
@@ -1981,7 +1987,7 @@ dmu_fsname(const char *snapname, char *b
        char *atp = strchr(snapname, '@');
        if (atp == NULL)
                return (SET_ERROR(EINVAL));
-       if (atp - snapname >= MAXNAMELEN)
+       if (atp - snapname >= ZFS_MAX_DATASET_NAME_LEN)
                return (SET_ERROR(ENAMETOOLONG));
        (void) strlcpy(buf, snapname, atp - snapname + 1);
        return (0);

Modified: vendor-sys/illumos/dist/uts/common/fs/zfs/dmu_send.c
==============================================================================
--- vendor-sys/illumos/dist/uts/common/fs/zfs/dmu_send.c        Tue Jul 12 
12:00:31 2016        (r302659)
+++ vendor-sys/illumos/dist/uts/common/fs/zfs/dmu_send.c        Tue Jul 12 
12:01:54 2016        (r302660)
@@ -1308,7 +1308,7 @@ dmu_recv_begin_check(void *arg, dmu_tx_t
                dsl_dataset_rele(ds, FTAG);
        } else if (error == ENOENT) {
                /* target fs does not exist; must be a full backup or clone */
-               char buf[MAXNAMELEN];
+               char buf[ZFS_MAX_DATASET_NAME_LEN];
 
                /*
                 * If it's a non-clone incremental, we are missing the
@@ -1328,7 +1328,7 @@ dmu_recv_begin_check(void *arg, dmu_tx_t
                        return (SET_ERROR(EINVAL));
 
                /* Open the parent of tofs */
-               ASSERT3U(strlen(tofs), <, MAXNAMELEN);
+               ASSERT3U(strlen(tofs), <, sizeof (buf));
                (void) strlcpy(buf, tofs, strrchr(tofs, '/') - tofs + 1);
                error = dsl_dataset_hold(dp, buf, FTAG, &ds);
                if (error != 0)
@@ -1512,7 +1512,8 @@ dmu_recv_resume_begin_check(void *arg, d
            !spa_feature_is_enabled(dp->dp_spa, SPA_FEATURE_LZ4_COMPRESS))
                return (SET_ERROR(ENOTSUP));
 
-       char recvname[ZFS_MAXNAMELEN];
+       /* 6 extra bytes for /%recv */
+       char recvname[ZFS_MAX_DATASET_NAME_LEN + 6];
 
        (void) snprintf(recvname, sizeof (recvname), "%s/%s",
            tofs, recv_clone_name);
@@ -1585,7 +1586,8 @@ dmu_recv_resume_begin_sync(void *arg, dm
        const char *tofs = drba->drba_cookie->drc_tofs;
        dsl_dataset_t *ds;
        uint64_t dsobj;
-       char recvname[ZFS_MAXNAMELEN];
+       /* 6 extra bytes for /%recv */
+       char recvname[ZFS_MAX_DATASET_NAME_LEN + 6];
 
        (void) snprintf(recvname, sizeof (recvname), "%s/%s",
            tofs, recv_clone_name);
@@ -2300,7 +2302,7 @@ dmu_recv_cleanup_ds(dmu_recv_cookie_t *d
                txg_wait_synced(drc->drc_ds->ds_dir->dd_pool, 0);
                dsl_dataset_disown(drc->drc_ds, dmu_recv_tag);
        } else {
-               char name[MAXNAMELEN];
+               char name[ZFS_MAX_DATASET_NAME_LEN];
                dsl_dataset_name(drc->drc_ds, name);
                dsl_dataset_disown(drc->drc_ds, dmu_recv_tag);
                (void) dsl_destroy_head(name);
@@ -3118,13 +3120,13 @@ static int
 dmu_recv_existing_end(dmu_recv_cookie_t *drc)
 {
        int error;
-       char name[MAXNAMELEN];
 
 #ifdef _KERNEL
        /*
         * We will be destroying the ds; make sure its origin is unmounted if
         * necessary.
         */
+       char name[ZFS_MAX_DATASET_NAME_LEN];
        dsl_dataset_name(drc->drc_ds, name);
        zfs_destroy_unmount_origin(name);
 #endif

Modified: vendor-sys/illumos/dist/uts/common/fs/zfs/dsl_bookmark.c
==============================================================================
--- vendor-sys/illumos/dist/uts/common/fs/zfs/dsl_bookmark.c    Tue Jul 12 
12:00:31 2016        (r302659)
+++ vendor-sys/illumos/dist/uts/common/fs/zfs/dsl_bookmark.c    Tue Jul 12 
12:01:54 2016        (r302660)
@@ -34,10 +34,10 @@ static int
 dsl_bookmark_hold_ds(dsl_pool_t *dp, const char *fullname,
     dsl_dataset_t **dsp, void *tag, char **shortnamep)
 {
-       char buf[MAXNAMELEN];
+       char buf[ZFS_MAX_DATASET_NAME_LEN];
        char *hashp;
 
-       if (strlen(fullname) >= MAXNAMELEN)
+       if (strlen(fullname) >= ZFS_MAX_DATASET_NAME_LEN)
                return (SET_ERROR(ENAMETOOLONG));
        hashp = strchr(fullname, '#');
        if (hashp == NULL)

Modified: vendor-sys/illumos/dist/uts/common/fs/zfs/dsl_dataset.c
==============================================================================
--- vendor-sys/illumos/dist/uts/common/fs/zfs/dsl_dataset.c     Tue Jul 12 
12:00:31 2016        (r302659)
+++ vendor-sys/illumos/dist/uts/common/fs/zfs/dsl_dataset.c     Tue Jul 12 
12:01:54 2016        (r302660)
@@ -665,22 +665,37 @@ dsl_dataset_name(dsl_dataset_t *ds, char
                dsl_dir_name(ds->ds_dir, name);
                VERIFY0(dsl_dataset_get_snapname(ds));
                if (ds->ds_snapname[0]) {
-                       (void) strcat(name, "@");
+                       VERIFY3U(strlcat(name, "@", ZFS_MAX_DATASET_NAME_LEN),
+                           <, ZFS_MAX_DATASET_NAME_LEN);
                        /*
                         * We use a "recursive" mutex so that we
                         * can call dprintf_ds() with ds_lock held.
                         */
                        if (!MUTEX_HELD(&ds->ds_lock)) {
                                mutex_enter(&ds->ds_lock);
-                               (void) strcat(name, ds->ds_snapname);
+                               VERIFY3U(strlcat(name, ds->ds_snapname,
+                                   ZFS_MAX_DATASET_NAME_LEN), <,
+                                   ZFS_MAX_DATASET_NAME_LEN);
                                mutex_exit(&ds->ds_lock);
                        } else {
-                               (void) strcat(name, ds->ds_snapname);
+                               VERIFY3U(strlcat(name, ds->ds_snapname,
+                                   ZFS_MAX_DATASET_NAME_LEN), <,
+                                   ZFS_MAX_DATASET_NAME_LEN);
                        }
                }
        }
 }
 
+int
+dsl_dataset_namelen(dsl_dataset_t *ds)
+{
+       VERIFY0(dsl_dataset_get_snapname(ds));
+       mutex_enter(&ds->ds_lock);
+       int len = dsl_dir_namelen(ds->ds_dir) + 1 + strlen(ds->ds_snapname);
+       mutex_exit(&ds->ds_lock);
+       return (len);
+}
+
 void
 dsl_dataset_rele(dsl_dataset_t *ds, void *tag)
 {
@@ -1243,10 +1258,10 @@ dsl_dataset_snapshot_check(void *arg, dm
                int error = 0;
                dsl_dataset_t *ds;
                char *name, *atp;
-               char dsname[MAXNAMELEN];
+               char dsname[ZFS_MAX_DATASET_NAME_LEN];
 
                name = nvpair_name(pair);
-               if (strlen(name) >= MAXNAMELEN)
+               if (strlen(name) >= ZFS_MAX_DATASET_NAME_LEN)
                        error = SET_ERROR(ENAMETOOLONG);
                if (error == 0) {
                        atp = strchr(name, '@');
@@ -1419,7 +1434,7 @@ dsl_dataset_snapshot_sync(void *arg, dmu
            pair != NULL; pair = nvlist_next_nvpair(ddsa->ddsa_snaps, pair)) {
                dsl_dataset_t *ds;
                char *name, *atp;
-               char dsname[MAXNAMELEN];
+               char dsname[ZFS_MAX_DATASET_NAME_LEN];
 
                name = nvpair_name(pair);
                atp = strchr(name, '@');
@@ -1465,7 +1480,7 @@ dsl_dataset_snapshot(nvlist_t *snaps, nv
                suspended = fnvlist_alloc();
                for (pair = nvlist_next_nvpair(snaps, NULL); pair != NULL;
                    pair = nvlist_next_nvpair(snaps, pair)) {
-                       char fsname[MAXNAMELEN];
+                       char fsname[ZFS_MAX_DATASET_NAME_LEN];
                        char *snapname = nvpair_name(pair);
                        char *atp;
                        void *cookie;
@@ -1672,7 +1687,7 @@ get_clones_stat(dsl_dataset_t *ds, nvlis
            zap_cursor_retrieve(&zc, &za) == 0;
            zap_cursor_advance(&zc)) {
                dsl_dataset_t *clone;
-               char buf[ZFS_MAXNAMELEN];
+               char buf[ZFS_MAX_DATASET_NAME_LEN];
                VERIFY0(dsl_dataset_hold_obj(ds->ds_dir->dd_pool,
                    za.za_first_integer, FTAG, &clone));
                dsl_dir_name(clone->ds_dir, buf);
@@ -1780,7 +1795,7 @@ dsl_dataset_stats(dsl_dataset_t *ds, nvl
                get_clones_stat(ds, nv);
        } else {
                if (ds->ds_prev != NULL && ds->ds_prev != dp->dp_origin_snap) {
-                       char buf[MAXNAMELEN];
+                       char buf[ZFS_MAX_DATASET_NAME_LEN];
                        dsl_dataset_name(ds->ds_prev, buf);
                        dsl_prop_nvlist_add_string(nv, ZFS_PROP_PREV_SNAP, buf);
                }
@@ -1841,12 +1856,15 @@ dsl_dataset_stats(dsl_dataset_t *ds, nvl
                 * stats set on our child named "%recv".  Check the child
                 * for the prop.
                 */
-               char recvname[ZFS_MAXNAMELEN];
+               /* 6 extra bytes for /%recv */
+               char recvname[ZFS_MAX_DATASET_NAME_LEN + 6];
                dsl_dataset_t *recv_ds;
                dsl_dataset_name(ds, recvname);
-               (void) strcat(recvname, "/");
-               (void) strcat(recvname, recv_clone_name);
-               if (dsl_dataset_hold(dp, recvname, FTAG, &recv_ds) == 0) {
+               if (strlcat(recvname, "/", sizeof (recvname)) <
+                   sizeof (recvname) &&
+                   strlcat(recvname, recv_clone_name, sizeof (recvname)) <
+                   sizeof (recvname) &&
+                   dsl_dataset_hold(dp, recvname, FTAG, &recv_ds) == 0) {
                        get_receive_resume_stats(recv_ds, nv);
                        dsl_dataset_rele(recv_ds, FTAG);
                }
@@ -1973,7 +1991,7 @@ dsl_dataset_rename_snapshot_check_impl(d
 
        /* dataset name + 1 for the "@" + the new snapshot name must fit */
        if (dsl_dir_namelen(hds->ds_dir) + 1 +
-           strlen(ddrsa->ddrsa_newsnapname) >= MAXNAMELEN)
+           strlen(ddrsa->ddrsa_newsnapname) >= ZFS_MAX_DATASET_NAME_LEN)
                error = SET_ERROR(ENAMETOOLONG);
 
        return (error);
@@ -2201,7 +2219,7 @@ dsl_dataset_rollback_sync(void *arg, dmu
        dsl_pool_t *dp = dmu_tx_pool(tx);
        dsl_dataset_t *ds, *clone;
        uint64_t cloneobj;
-       char namebuf[ZFS_MAXNAMELEN];
+       char namebuf[ZFS_MAX_DATASET_NAME_LEN];
 
        VERIFY0(dsl_dataset_hold(dp, ddra->ddra_fsname, FTAG, &ds));
 
@@ -2754,7 +2772,7 @@ promote_rele(dsl_dataset_promote_arg_t *
  * Promote a clone.
  *
  * If it fails due to a conflicting snapshot name, "conflsnap" will be filled
- * in with the name.  (It must be at least MAXNAMELEN bytes long.)
+ * in with the name.  (It must be at least ZFS_MAX_DATASET_NAME_LEN bytes 
long.)
  */
 int
 dsl_dataset_promote(const char *name, char *conflsnap)

Modified: vendor-sys/illumos/dist/uts/common/fs/zfs/dsl_deleg.c
==============================================================================
--- vendor-sys/illumos/dist/uts/common/fs/zfs/dsl_deleg.c       Tue Jul 12 
12:00:31 2016        (r302659)
+++ vendor-sys/illumos/dist/uts/common/fs/zfs/dsl_deleg.c       Tue Jul 12 
12:01:54 2016        (r302660)
@@ -20,7 +20,7 @@
  */
 /*
  * Copyright (c) 2007, 2010, Oracle and/or its affiliates. All rights reserved.
- * Copyright (c) 2011, 2014 by Delphix. All rights reserved.
+ * Copyright (c) 2011, 2015 by Delphix. All rights reserved.
  */
 
 /*
@@ -330,7 +330,7 @@ dsl_deleg_get(const char *ddname, nvlist
                zap_attribute_t baseza;
                nvlist_t *sp_nvp;
                uint64_t n;
-               char source[MAXNAMELEN];
+               char source[ZFS_MAX_DATASET_NAME_LEN];
 
                if (dsl_dir_phys(dd)->dd_deleg_zapobj == 0 ||
                    zap_count(mos,

Modified: vendor-sys/illumos/dist/uts/common/fs/zfs/dsl_dir.c
==============================================================================
--- vendor-sys/illumos/dist/uts/common/fs/zfs/dsl_dir.c Tue Jul 12 12:00:31 
2016        (r302659)
+++ vendor-sys/illumos/dist/uts/common/fs/zfs/dsl_dir.c Tue Jul 12 12:01:54 
2016        (r302660)
@@ -298,13 +298,14 @@ dsl_dir_async_rele(dsl_dir_t *dd, void *
        dmu_buf_rele(dd->dd_dbuf, tag);
 }
 
-/* buf must be long enough (MAXNAMELEN + strlen(MOS_DIR_NAME) + 1 should do) */
+/* buf must be at least ZFS_MAX_DATASET_NAME_LEN bytes */
 void
 dsl_dir_name(dsl_dir_t *dd, char *buf)
 {
        if (dd->dd_parent) {
                dsl_dir_name(dd->dd_parent, buf);
-               (void) strcat(buf, "/");
+               VERIFY3U(strlcat(buf, "/", ZFS_MAX_DATASET_NAME_LEN), <,
+                   ZFS_MAX_DATASET_NAME_LEN);
        } else {
                buf[0] = '\0';
        }
@@ -314,10 +315,12 @@ dsl_dir_name(dsl_dir_t *dd, char *buf)
                 * dprintf_dd() with dd_lock held
                 */
                mutex_enter(&dd->dd_lock);
-               (void) strcat(buf, dd->dd_myname);
+               VERIFY3U(strlcat(buf, dd->dd_myname, ZFS_MAX_DATASET_NAME_LEN),
+                   <, ZFS_MAX_DATASET_NAME_LEN);
                mutex_exit(&dd->dd_lock);
        } else {
-               (void) strcat(buf, dd->dd_myname);
+               VERIFY3U(strlcat(buf, dd->dd_myname, ZFS_MAX_DATASET_NAME_LEN),
+                   <, ZFS_MAX_DATASET_NAME_LEN);
        }
 }
 
@@ -366,12 +369,12 @@ getcomponent(const char *path, char *com
                if (p != NULL &&
                    (p[0] != '@' || strpbrk(path+1, "/@") || p[1] == '\0'))
                        return (SET_ERROR(EINVAL));
-               if (strlen(path) >= MAXNAMELEN)
+               if (strlen(path) >= ZFS_MAX_DATASET_NAME_LEN)
                        return (SET_ERROR(ENAMETOOLONG));
                (void) strcpy(component, path);
                p = NULL;
        } else if (p[0] == '/') {
-               if (p - path >= MAXNAMELEN)
+               if (p - path >= ZFS_MAX_DATASET_NAME_LEN)
                        return (SET_ERROR(ENAMETOOLONG));
                (void) strncpy(component, path, p - path);
                component[p - path] = '\0';
@@ -383,7 +386,7 @@ getcomponent(const char *path, char *com
                 */
                if (strchr(path, '/'))
                        return (SET_ERROR(EINVAL));
-               if (p - path >= MAXNAMELEN)
+               if (p - path >= ZFS_MAX_DATASET_NAME_LEN)
                        return (SET_ERROR(ENAMETOOLONG));
                (void) strncpy(component, path, p - path);
                component[p - path] = '\0';
@@ -405,7 +408,7 @@ int
 dsl_dir_hold(dsl_pool_t *dp, const char *name, void *tag,
     dsl_dir_t **ddp, const char **tailp)
 {
-       char buf[MAXNAMELEN];
+       char buf[ZFS_MAX_DATASET_NAME_LEN];
        const char *spaname, *next, *nextnext = NULL;
        int err;
        dsl_dir_t *dd;
@@ -968,7 +971,7 @@ dsl_dir_stats(dsl_dir_t *dd, nvlist_t *n
 
        if (dsl_dir_is_clone(dd)) {
                dsl_dataset_t *ds;
-               char buf[MAXNAMELEN];
+               char buf[ZFS_MAX_DATASET_NAME_LEN];
 
                VERIFY0(dsl_dataset_hold_obj(dd->dd_pool,
                    dsl_dir_phys(dd)->dd_origin_obj, FTAG, &ds));
@@ -1676,11 +1679,11 @@ static int
 dsl_valid_rename(dsl_pool_t *dp, dsl_dataset_t *ds, void *arg)
 {
        int *deltap = arg;
-       char namebuf[MAXNAMELEN];
+       char namebuf[ZFS_MAX_DATASET_NAME_LEN];
 
        dsl_dataset_name(ds, namebuf);
 
-       if (strlen(namebuf) + *deltap >= MAXNAMELEN)
+       if (strlen(namebuf) + *deltap >= ZFS_MAX_DATASET_NAME_LEN)
                return (SET_ERROR(ENAMETOOLONG));
        return (0);
 }

Modified: vendor-sys/illumos/dist/uts/common/fs/zfs/dsl_prop.c
==============================================================================
--- vendor-sys/illumos/dist/uts/common/fs/zfs/dsl_prop.c        Tue Jul 12 
12:00:31 2016        (r302659)
+++ vendor-sys/illumos/dist/uts/common/fs/zfs/dsl_prop.c        Tue Jul 12 
12:01:54 2016        (r302660)
@@ -20,7 +20,7 @@
  */
 /*
  * Copyright (c) 2005, 2010, Oracle and/or its affiliates. All rights reserved.
- * Copyright (c) 2012, 2014 by Delphix. All rights reserved.
+ * Copyright (c) 2012, 2015 by Delphix. All rights reserved.
  * Copyright (c) 2013 Martin Matuska. All rights reserved.
  * Copyright 2015, Joyent, Inc.
  */
@@ -1058,7 +1058,7 @@ dsl_prop_get_all_ds(dsl_dataset_t *ds, n
        dsl_pool_t *dp = dd->dd_pool;
        objset_t *mos = dp->dp_meta_objset;
        int err = 0;
-       char setpoint[MAXNAMELEN];
+       char setpoint[ZFS_MAX_DATASET_NAME_LEN];
 
        VERIFY(nvlist_alloc(nvp, NV_UNIQUE_NAME, KM_SLEEP) == 0);
 

Modified: vendor-sys/illumos/dist/uts/common/fs/zfs/dsl_scan.c
==============================================================================
--- vendor-sys/illumos/dist/uts/common/fs/zfs/dsl_scan.c        Tue Jul 12 
12:00:31 2016        (r302659)
+++ vendor-sys/illumos/dist/uts/common/fs/zfs/dsl_scan.c        Tue Jul 12 
12:01:54 2016        (r302660)
@@ -1087,7 +1087,7 @@ dsl_scan_visitds(dsl_scan_t *scn, uint64
        dmu_buf_will_dirty(ds->ds_dbuf, tx);
        dsl_scan_visit_rootbp(scn, ds, &dsl_dataset_phys(ds)->ds_bp, tx);
 
-       char *dsname = kmem_alloc(ZFS_MAXNAMELEN, KM_SLEEP);
+       char *dsname = kmem_alloc(ZFS_MAX_DATASET_NAME_LEN, KM_SLEEP);
        dsl_dataset_name(ds, dsname);
        zfs_dbgmsg("scanned dataset %llu (%s) with min=%llu max=%llu; "
            "pausing=%u",
@@ -1095,7 +1095,7 @@ dsl_scan_visitds(dsl_scan_t *scn, uint64
            (longlong_t)scn->scn_phys.scn_cur_min_txg,
            (longlong_t)scn->scn_phys.scn_cur_max_txg,
            (int)scn->scn_pausing);
-       kmem_free(dsname, ZFS_MAXNAMELEN);
+       kmem_free(dsname, ZFS_MAX_DATASET_NAME_LEN);
 
        if (scn->scn_pausing)
                goto out;

Modified: vendor-sys/illumos/dist/uts/common/fs/zfs/dsl_userhold.c
==============================================================================
--- vendor-sys/illumos/dist/uts/common/fs/zfs/dsl_userhold.c    Tue Jul 12 
12:00:31 2016        (r302659)
+++ vendor-sys/illumos/dist/uts/common/fs/zfs/dsl_userhold.c    Tue Jul 12 
12:01:54 2016        (r302660)
@@ -20,7 +20,7 @@
  */
 /*
  * Copyright (c) 2005, 2010, Oracle and/or its affiliates. All rights reserved.
- * Copyright (c) 2012, 2014 by Delphix. All rights reserved.
+ * Copyright (c) 2012, 2015 by Delphix. All rights reserved.
  * Copyright (c) 2013 Steven Hartland. All rights reserved.
  */
 
@@ -180,7 +180,7 @@ dsl_dataset_user_hold_sync_one_impl(nvli
 }
 
 typedef struct zfs_hold_cleanup_arg {
-       char zhca_spaname[MAXNAMELEN];
+       char zhca_spaname[ZFS_MAX_DATASET_NAME_LEN];
        uint64_t zhca_spa_load_guid;
        nvlist_t *zhca_holds;
 } zfs_hold_cleanup_arg_t;
@@ -574,7 +574,7 @@ dsl_dataset_user_release_impl(nvlist_t *
                        error = dsl_dataset_hold_obj_string(tmpdp,
                            nvpair_name(pair), FTAG, &ds);
                        if (error == 0) {
-                               char name[MAXNAMELEN];
+                               char name[ZFS_MAX_DATASET_NAME_LEN];
                                dsl_dataset_name(ds, name);
                                dsl_pool_config_exit(tmpdp, FTAG);
                                dsl_dataset_rele(ds, FTAG);

Modified: vendor-sys/illumos/dist/uts/common/fs/zfs/spa.c
==============================================================================
--- vendor-sys/illumos/dist/uts/common/fs/zfs/spa.c     Tue Jul 12 12:00:31 
2016        (r302659)
+++ vendor-sys/illumos/dist/uts/common/fs/zfs/spa.c     Tue Jul 12 12:01:54 
2016        (r302660)
@@ -350,8 +350,7 @@ spa_prop_get(spa_t *spa, nvlist_t **nvp)
                                        break;
                                }
 
-                               strval = kmem_alloc(
-                                   MAXNAMELEN + strlen(MOS_DIR_NAME) + 1,
+                               strval = kmem_alloc(ZFS_MAX_DATASET_NAME_LEN,
                                    KM_SLEEP);
                                dsl_dataset_name(ds, strval);
                                dsl_dataset_rele(ds, FTAG);
@@ -364,8 +363,7 @@ spa_prop_get(spa_t *spa, nvlist_t **nvp)
                        spa_prop_add_list(*nvp, prop, strval, intval, src);
 
                        if (strval != NULL)
-                               kmem_free(strval,
-                                   MAXNAMELEN + strlen(MOS_DIR_NAME) + 1);
+                               kmem_free(strval, ZFS_MAX_DATASET_NAME_LEN);
 
                        break;
 
@@ -1930,11 +1928,8 @@ spa_load_verify_cb(spa_t *spa, zilog_t *
 int
 verify_dataset_name_len(dsl_pool_t *dp, dsl_dataset_t *ds, void *arg)
 {
-       char namebuf[MAXPATHLEN];
-       dsl_dataset_name(ds, namebuf);
-       if (strlen(namebuf) > MAXNAMELEN) {
+       if (dsl_dataset_namelen(ds) >= ZFS_MAX_DATASET_NAME_LEN)
                return (SET_ERROR(ENAMETOOLONG));
-       }
 
        return (0);
 }

Modified: vendor-sys/illumos/dist/uts/common/fs/zfs/spa_history.c
==============================================================================
--- vendor-sys/illumos/dist/uts/common/fs/zfs/spa_history.c     Tue Jul 12 
12:00:31 2016        (r302659)
+++ vendor-sys/illumos/dist/uts/common/fs/zfs/spa_history.c     Tue Jul 12 
12:01:54 2016        (r302660)
@@ -21,7 +21,7 @@
 
 /*
  * Copyright (c) 2006, 2010, Oracle and/or its affiliates. All rights reserved.
- * Copyright (c) 2011, 2014 by Delphix. All rights reserved.
+ * Copyright (c) 2011, 2015 by Delphix. All rights reserved.
  * Copyright (c) 2014 Integros [integros.com]
  */
 
@@ -494,7 +494,7 @@ spa_history_log_internal_ds(dsl_dataset_
     dmu_tx_t *tx, const char *fmt, ...)
 {
        va_list adx;
-       char namebuf[MAXNAMELEN];
+       char namebuf[ZFS_MAX_DATASET_NAME_LEN];
        nvlist_t *nvl = fnvlist_alloc();
 
        ASSERT(tx != NULL);
@@ -513,7 +513,7 @@ spa_history_log_internal_dd(dsl_dir_t *d
     dmu_tx_t *tx, const char *fmt, ...)
 {
        va_list adx;
-       char namebuf[MAXNAMELEN];
+       char namebuf[ZFS_MAX_DATASET_NAME_LEN];
        nvlist_t *nvl = fnvlist_alloc();
 
        ASSERT(tx != NULL);

Modified: vendor-sys/illumos/dist/uts/common/fs/zfs/sys/dmu.h
==============================================================================
--- vendor-sys/illumos/dist/uts/common/fs/zfs/sys/dmu.h Tue Jul 12 12:00:31 
2016        (r302659)
+++ vendor-sys/illumos/dist/uts/common/fs/zfs/sys/dmu.h Tue Jul 12 12:01:54 
2016        (r302660)
@@ -807,7 +807,7 @@ typedef struct dmu_objset_stats {
        dmu_objset_type_t dds_type;
        uint8_t dds_is_snapshot;
        uint8_t dds_inconsistent;
-       char dds_origin[MAXNAMELEN];
+       char dds_origin[ZFS_MAX_DATASET_NAME_LEN];
 } dmu_objset_stats_t;
 
 /*

Modified: vendor-sys/illumos/dist/uts/common/fs/zfs/sys/dsl_dataset.h
==============================================================================
--- vendor-sys/illumos/dist/uts/common/fs/zfs/sys/dsl_dataset.h Tue Jul 12 
12:00:31 2016        (r302659)
+++ vendor-sys/illumos/dist/uts/common/fs/zfs/sys/dsl_dataset.h Tue Jul 12 
12:01:54 2016        (r302660)
@@ -221,7 +221,7 @@ typedef struct dsl_dataset {
        uint8_t ds_feature_activation_needed[SPA_FEATURES];
 
        /* Protected by ds_lock; keep at end of struct for better locality */
-       char ds_snapname[MAXNAMELEN];
+       char ds_snapname[ZFS_MAX_DATASET_NAME_LEN];
 } dsl_dataset_t;
 
 inline dsl_dataset_phys_t *
@@ -256,6 +256,7 @@ int dsl_dataset_own_obj(struct dsl_pool 
 void dsl_dataset_disown(dsl_dataset_t *ds, void *tag);
 void dsl_dataset_name(dsl_dataset_t *ds, char *name);
 boolean_t dsl_dataset_tryown(dsl_dataset_t *ds, void *tag);
+int dsl_dataset_namelen(dsl_dataset_t *ds);
 boolean_t dsl_dataset_has_owner(dsl_dataset_t *ds);
 uint64_t dsl_dataset_create_sync(dsl_dir_t *pds, const char *lastname,
     dsl_dataset_t *origin, uint64_t flags, cred_t *, dmu_tx_t *);
@@ -347,10 +348,10 @@ void dsl_dataset_deactivate_feature(uint
 #ifdef ZFS_DEBUG
 #define        dprintf_ds(ds, fmt, ...) do { \
        if (zfs_flags & ZFS_DEBUG_DPRINTF) { \
-       char *__ds_name = kmem_alloc(MAXNAMELEN, KM_SLEEP); \
+       char *__ds_name = kmem_alloc(ZFS_MAX_DATASET_NAME_LEN, KM_SLEEP); \
        dsl_dataset_name(ds, __ds_name); \
        dprintf("ds=%s " fmt, __ds_name, __VA_ARGS__); \
-       kmem_free(__ds_name, MAXNAMELEN); \
+       kmem_free(__ds_name, ZFS_MAX_DATASET_NAME_LEN); \
        } \
 _NOTE(CONSTCOND) } while (0)
 #else

Modified: vendor-sys/illumos/dist/uts/common/fs/zfs/sys/dsl_dir.h
==============================================================================
--- vendor-sys/illumos/dist/uts/common/fs/zfs/sys/dsl_dir.h     Tue Jul 12 
12:00:31 2016        (r302659)
+++ vendor-sys/illumos/dist/uts/common/fs/zfs/sys/dsl_dir.h     Tue Jul 12 
12:01:54 2016        (r302660)
@@ -112,7 +112,7 @@ struct dsl_dir {
        int64_t dd_space_towrite[TXG_SIZE];
 
        /* protected by dd_lock; keep at end of struct for better locality */
-       char dd_myname[MAXNAMELEN];
+       char dd_myname[ZFS_MAX_DATASET_NAME_LEN];
 };
 
 inline dsl_dir_phys_t *
@@ -176,11 +176,10 @@ boolean_t dsl_dir_is_zapified(dsl_dir_t 
 #ifdef ZFS_DEBUG
 #define        dprintf_dd(dd, fmt, ...) do { \
        if (zfs_flags & ZFS_DEBUG_DPRINTF) { \
-       char *__ds_name = kmem_alloc(MAXNAMELEN + strlen(MOS_DIR_NAME) + 1, \
-           KM_SLEEP); \
+       char *__ds_name = kmem_alloc(ZFS_MAX_DATASET_NAME_LEN, KM_SLEEP); \
        dsl_dir_name(dd, __ds_name); \
        dprintf("dd=%s " fmt, __ds_name, __VA_ARGS__); \
-       kmem_free(__ds_name, MAXNAMELEN + strlen(MOS_DIR_NAME) + 1); \
+       kmem_free(__ds_name, ZFS_MAX_DATASET_NAME_LEN); \
        } \
 _NOTE(CONSTCOND) } while (0)
 #else

Modified: vendor-sys/illumos/dist/uts/common/fs/zfs/sys/spa_impl.h
==============================================================================
--- vendor-sys/illumos/dist/uts/common/fs/zfs/sys/spa_impl.h    Tue Jul 12 
12:00:31 2016        (r302659)
+++ vendor-sys/illumos/dist/uts/common/fs/zfs/sys/spa_impl.h    Tue Jul 12 
12:01:54 2016        (r302660)
@@ -126,7 +126,7 @@ struct spa {
        /*
         * Fields protected by spa_namespace_lock.
         */
-       char            spa_name[MAXNAMELEN];   /* pool name */
+       char            spa_name[ZFS_MAX_DATASET_NAME_LEN];     /* pool name */
        char            *spa_comment;           /* comment */
        avl_node_t      spa_avl;                /* node in spa_namespace_avl */
        nvlist_t        *spa_config;            /* last synced config */

Modified: vendor-sys/illumos/dist/uts/common/fs/zfs/sys/zap.h
==============================================================================
--- vendor-sys/illumos/dist/uts/common/fs/zfs/sys/zap.h Tue Jul 12 12:00:31 
2016        (r302659)
+++ vendor-sys/illumos/dist/uts/common/fs/zfs/sys/zap.h Tue Jul 12 12:01:54 
2016        (r302660)
@@ -344,7 +344,7 @@ typedef struct {
        boolean_t za_normalization_conflict;
        uint64_t za_num_integers;
        uint64_t za_first_integer;      /* no sign extension for <8byte ints */
-       char za_name[MAXNAMELEN];
+       char za_name[ZAP_MAXNAMELEN];
 } zap_attribute_t;
 
 /*

Modified: vendor-sys/illumos/dist/uts/common/fs/zfs/sys/zfs_znode.h
==============================================================================
--- vendor-sys/illumos/dist/uts/common/fs/zfs/sys/zfs_znode.h   Tue Jul 12 
12:00:31 2016        (r302659)
+++ vendor-sys/illumos/dist/uts/common/fs/zfs/sys/zfs_znode.h   Tue Jul 12 
12:01:54 2016        (r302660)
@@ -20,7 +20,7 @@
  */
 /*
  * Copyright (c) 2005, 2010, Oracle and/or its affiliates. All rights reserved.
- * Copyright (c) 2012 by Delphix. All rights reserved.
+ * Copyright (c) 2012, 2015 by Delphix. All rights reserved.
  * Copyright (c) 2014 Integros [integros.com]
  */
 
@@ -138,17 +138,6 @@ extern "C" {
 #define        ZFS_SA_ATTRS            "SA_ATTRS"
 
 /*
- * Path component length
- *
- * The generic fs code uses MAXNAMELEN to represent
- * what the largest component length is.  Unfortunately,
- * this length includes the terminating NULL.  ZFS needs
- * to tell the users via pathconf() and statvfs() what the
- * true maximum length of a component is, excluding the NULL.
- */
-#define        ZFS_MAXNAMELEN  (MAXNAMELEN - 1)
-
-/*
  * Convert mode bits (zp_mode) to BSD-style DT_* values for storing in
  * the directory entries.
  */

Modified: vendor-sys/illumos/dist/uts/common/fs/zfs/zfs_ctldir.c
==============================================================================
--- vendor-sys/illumos/dist/uts/common/fs/zfs/zfs_ctldir.c      Tue Jul 12 
12:00:31 2016        (r302659)
+++ vendor-sys/illumos/dist/uts/common/fs/zfs/zfs_ctldir.c      Tue Jul 12 
12:01:54 2016        (r302660)
@@ -20,7 +20,7 @@
  */
 /*
  * Copyright (c) 2005, 2010, Oracle and/or its affiliates. All rights reserved.
- * Copyright (c) 2012, 2014 by Delphix. All rights reserved.
+ * Copyright (c) 2012, 2015 by Delphix. All rights reserved.
  * Copyright 2015, OmniTI Computer Consulting, Inc. All rights reserved.
  */
 
@@ -621,8 +621,8 @@ zfsctl_snapdir_rename(vnode_t *sdvp, cha
        zfs_snapentry_t search, *sep;
        zfsvfs_t *zfsvfs;
        avl_index_t where;
-       char from[MAXNAMELEN], to[MAXNAMELEN];
-       char real[MAXNAMELEN], fsname[MAXNAMELEN];
+       char from[ZFS_MAX_DATASET_NAME_LEN], to[ZFS_MAX_DATASET_NAME_LEN];
+       char real[ZFS_MAX_DATASET_NAME_LEN], fsname[ZFS_MAX_DATASET_NAME_LEN];
        int err;
 
        zfsvfs = sdvp->v_vfsp->vfs_data;
@@ -630,7 +630,7 @@ zfsctl_snapdir_rename(vnode_t *sdvp, cha
 
        if ((flags & FIGNORECASE) || zfsvfs->z_case == ZFS_CASE_INSENSITIVE) {
                err = dmu_snapshot_realname(zfsvfs->z_os, snm, real,
-                   MAXNAMELEN, NULL);
+                   sizeof (real), NULL);
                if (err == 0) {
                        snm = real;
                } else if (err != ENOTSUP) {
@@ -643,9 +643,9 @@ zfsctl_snapdir_rename(vnode_t *sdvp, cha
 
        dmu_objset_name(zfsvfs->z_os, fsname);
 
-       err = zfsctl_snapshot_zname(sdvp, snm, MAXNAMELEN, from);
+       err = zfsctl_snapshot_zname(sdvp, snm, sizeof (from), from);
        if (err == 0)
-               err = zfsctl_snapshot_zname(tdvp, tnm, MAXNAMELEN, to);
+               err = zfsctl_snapshot_zname(tdvp, tnm, sizeof (to), to);
        if (err == 0)
                err = zfs_secpolicy_rename_perms(from, to, cr);
        if (err != 0)
@@ -686,8 +686,8 @@ zfsctl_snapdir_remove(vnode_t *dvp, char
        zfs_snapentry_t *sep;
        zfs_snapentry_t search;
        zfsvfs_t *zfsvfs;
-       char snapname[MAXNAMELEN];
-       char real[MAXNAMELEN];
+       char snapname[ZFS_MAX_DATASET_NAME_LEN];
+       char real[ZFS_MAX_DATASET_NAME_LEN];
        int err;
 
        zfsvfs = dvp->v_vfsp->vfs_data;
@@ -696,7 +696,7 @@ zfsctl_snapdir_remove(vnode_t *dvp, char
        if ((flags & FIGNORECASE) || zfsvfs->z_case == ZFS_CASE_INSENSITIVE) {
 
                err = dmu_snapshot_realname(zfsvfs->z_os, name, real,
-                   MAXNAMELEN, NULL);
+                   sizeof (real), NULL);
                if (err == 0) {
                        name = real;
                } else if (err != ENOTSUP) {
@@ -707,7 +707,7 @@ zfsctl_snapdir_remove(vnode_t *dvp, char
 
        ZFS_EXIT(zfsvfs);
 
-       err = zfsctl_snapshot_zname(dvp, name, MAXNAMELEN, snapname);
+       err = zfsctl_snapshot_zname(dvp, name, sizeof (snapname), snapname);
        if (err == 0)
                err = zfs_secpolicy_destroy_perms(snapname, cr);
        if (err != 0)
@@ -742,7 +742,7 @@ zfsctl_snapdir_mkdir(vnode_t *dvp, char 
     cred_t *cr, caller_context_t *cc, int flags, vsecattr_t *vsecp)
 {
        zfsvfs_t *zfsvfs = dvp->v_vfsp->vfs_data;
-       char name[MAXNAMELEN];
+       char name[ZFS_MAX_DATASET_NAME_LEN];
        int err;
        static enum symfollow follow = NO_FOLLOW;
        static enum uio_seg seg = UIO_SYSSPACE;
@@ -781,8 +781,8 @@ zfsctl_snapdir_lookup(vnode_t *dvp, char
 {
        zfsctl_snapdir_t *sdp = dvp->v_data;
        objset_t *snap;
-       char snapname[MAXNAMELEN];
-       char real[MAXNAMELEN];
+       char snapname[ZFS_MAX_DATASET_NAME_LEN];
+       char real[ZFS_MAX_DATASET_NAME_LEN];
        char *mountpoint;
        zfs_snapentry_t *sep, search;
        struct mounta margs;
@@ -820,7 +820,7 @@ zfsctl_snapdir_lookup(vnode_t *dvp, char
                boolean_t conflict = B_FALSE;
 
                err = dmu_snapshot_realname(zfsvfs->z_os, nm, real,
-                   MAXNAMELEN, &conflict);
+                   sizeof (real), &conflict);
                if (err == 0) {
                        nm = real;
                } else if (err != ENOTSUP) {
@@ -865,7 +865,7 @@ zfsctl_snapdir_lookup(vnode_t *dvp, char
        /*
         * The requested snapshot is not currently mounted, look it up.
         */
-       err = zfsctl_snapshot_zname(dvp, nm, MAXNAMELEN, snapname);
+       err = zfsctl_snapshot_zname(dvp, nm, sizeof (snapname), snapname);
        if (err != 0) {
                mutex_exit(&sdp->sd_lock);
                ZFS_EXIT(zfsvfs);
@@ -984,7 +984,7 @@ zfsctl_snapdir_readdir_cb(vnode_t *vp, v
     offset_t *offp, offset_t *nextp, void *data, int flags)
 {
        zfsvfs_t *zfsvfs = vp->v_vfsp->vfs_data;
-       char snapname[MAXNAMELEN];
+       char snapname[ZFS_MAX_DATASET_NAME_LEN];
        uint64_t id, cookie;
        boolean_t case_conflict;
        int error;
@@ -993,8 +993,8 @@ zfsctl_snapdir_readdir_cb(vnode_t *vp, v
 
        cookie = *offp;
        dsl_pool_config_enter(dmu_objset_pool(zfsvfs->z_os), FTAG);
-       error = dmu_snapshot_list_next(zfsvfs->z_os, MAXNAMELEN, snapname, &id,
-           &cookie, &case_conflict);
+       error = dmu_snapshot_list_next(zfsvfs->z_os,
+           sizeof (snapname), snapname, &id, &cookie, &case_conflict);
        dsl_pool_config_exit(dmu_objset_pool(zfsvfs->z_os), FTAG);
        if (error) {
                ZFS_EXIT(zfsvfs);

Modified: vendor-sys/illumos/dist/uts/common/fs/zfs/zfs_ioctl.c
==============================================================================
--- vendor-sys/illumos/dist/uts/common/fs/zfs/zfs_ioctl.c       Tue Jul 12 
12:00:31 2016        (r302659)
+++ vendor-sys/illumos/dist/uts/common/fs/zfs/zfs_ioctl.c       Tue Jul 12 
12:01:54 2016        (r302660)
@@ -628,7 +628,7 @@ zfs_secpolicy_setprop(const char *dsname
        case ZFS_PROP_SNAPSHOT_LIMIT:
                if (!INGLOBALZONE(curproc)) {
                        uint64_t zoned;
-                       char setpoint[MAXNAMELEN];
+                       char setpoint[ZFS_MAX_DATASET_NAME_LEN];
                        /*
                         * Unprivileged users are allowed to modify the
                         * limit on things *under* (ie. contained by)
@@ -860,7 +860,7 @@ zfs_secpolicy_destroy_snaps(zfs_cmd_t *z
 int
 zfs_secpolicy_rename_perms(const char *from, const char *to, cred_t *cr)
 {
-       char    parentname[MAXNAMELEN];
+       char    parentname[ZFS_MAX_DATASET_NAME_LEN];
        int     error;
 
        if ((error = zfs_secpolicy_write_perms(from,
@@ -913,7 +913,7 @@ zfs_secpolicy_promote(zfs_cmd_t *zc, nvl
        error = dsl_dataset_hold(dp, zc->zc_name, FTAG, &clone);
 
        if (error == 0) {
-               char parentname[MAXNAMELEN];
+               char parentname[ZFS_MAX_DATASET_NAME_LEN];
                dsl_dataset_t *origin = NULL;
                dsl_dir_t *dd;
                dd = clone->ds_dir;
@@ -1082,7 +1082,7 @@ zfs_secpolicy_log_history(zfs_cmd_t *zc,
 static int
 zfs_secpolicy_create_clone(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
 {
-       char    parentname[MAXNAMELEN];
+       char    parentname[ZFS_MAX_DATASET_NAME_LEN];
        int     error;
        char    *origin;
 
@@ -1225,7 +1225,7 @@ zfs_secpolicy_hold(zfs_cmd_t *zc, nvlist
 
        for (pair = nvlist_next_nvpair(holds, NULL); pair != NULL;
            pair = nvlist_next_nvpair(holds, pair)) {
-               char fsname[MAXNAMELEN];
+               char fsname[ZFS_MAX_DATASET_NAME_LEN];
                error = dmu_fsname(nvpair_name(pair), fsname);
                if (error != 0)
                        return (error);
@@ -1246,7 +1246,7 @@ zfs_secpolicy_release(zfs_cmd_t *zc, nvl
 
        for (pair = nvlist_next_nvpair(innvl, NULL); pair != NULL;
            pair = nvlist_next_nvpair(innvl, pair)) {
-               char fsname[MAXNAMELEN];
+               char fsname[ZFS_MAX_DATASET_NAME_LEN];
                error = dmu_fsname(nvpair_name(pair), fsname);
                if (error != 0)
                        return (error);
@@ -2292,7 +2292,8 @@ zfs_ioc_snapshot_list_next(zfs_cmd_t *zc
         * A dataset name of maximum length cannot have any snapshots,
         * so exit immediately.
         */
-       if (strlcat(zc->zc_name, "@", sizeof (zc->zc_name)) >= MAXNAMELEN) {
+       if (strlcat(zc->zc_name, "@", sizeof (zc->zc_name)) >=
+           ZFS_MAX_DATASET_NAME_LEN) {
                dmu_objset_rele(os, FTAG);
                return (SET_ERROR(ESRCH));
        }
@@ -3098,7 +3099,7 @@ zfs_fill_zplprops(const char *dataset, n
        boolean_t fuids_ok, sa_ok;
        uint64_t zplver = ZPL_VERSION;
        objset_t *os = NULL;
-       char parentname[MAXNAMELEN];
+       char parentname[ZFS_MAX_DATASET_NAME_LEN];
        char *cp;
        spa_t *spa;
        uint64_t spa_vers;
@@ -3459,7 +3460,7 @@ zfs_destroy_unmount_origin(const char *f
                return;
        ds = dmu_objset_ds(os);
        if (dsl_dir_is_clone(ds->ds_dir) && DS_IS_DEFER_DESTROY(ds->ds_prev)) {
-               char originname[MAXNAMELEN];
+               char originname[ZFS_MAX_DATASET_NAME_LEN];
                dsl_dataset_name(ds->ds_prev, originname);
                dmu_objset_rele(os, FTAG);
                (void) zfs_unmount_snap(originname);
@@ -3654,7 +3655,7 @@ static int
 recursive_unmount(const char *fsname, void *arg)
 {
        const char *snapname = arg;
-       char fullname[MAXNAMELEN];
+       char fullname[ZFS_MAX_DATASET_NAME_LEN];
 
        (void) snprintf(fullname, sizeof (fullname), "%s@%s", fsname, snapname);
        return (zfs_unmount_snap(fullname));
@@ -4182,7 +4183,7 @@ zfs_ioc_recv(zfs_cmd_t *zc)
        nvlist_t *delayprops = NULL; /* sent properties applied post-receive */
        char *origin = NULL;
        char *tosnap;
-       char tofs[ZFS_MAXNAMELEN];
+       char tofs[ZFS_MAX_DATASET_NAME_LEN];
        boolean_t first_recvd_props = B_FALSE;
 
        if (dataset_namecheck(zc->zc_value, NULL, NULL) != 0 ||

Modified: vendor-sys/illumos/dist/uts/common/fs/zfs/zfs_vfsops.c
==============================================================================
--- vendor-sys/illumos/dist/uts/common/fs/zfs/zfs_vfsops.c      Tue Jul 12 
12:00:31 2016        (r302659)
+++ vendor-sys/illumos/dist/uts/common/fs/zfs/zfs_vfsops.c      Tue Jul 12 
12:01:54 2016        (r302660)
@@ -496,7 +496,7 @@ zfs_register_callbacks(vfs_t *vfsp)
        } else if (vfs_optionisset(vfsp, MNTOPT_NBMAND, NULL)) {
                nbmand = B_TRUE;
        } else {
-               char osname[MAXNAMELEN];
+               char osname[ZFS_MAX_DATASET_NAME_LEN];
 
                dmu_objset_name(os, osname);
                if (error = dsl_prop_get_integer(osname, "nbmand", &nbmand,
@@ -1696,7 +1696,7 @@ zfs_statvfs(vfs_t *vfsp, struct statvfs6
 
        statp->f_flag = vf_to_stf(vfsp->vfs_flag);
 
-       statp->f_namemax = ZFS_MAXNAMELEN;
+       statp->f_namemax = MAXNAMELEN - 1;
 
        /*
         * We have all of 32 characters to stuff a string here.

Modified: vendor-sys/illumos/dist/uts/common/fs/zfs/zil.c
==============================================================================
--- vendor-sys/illumos/dist/uts/common/fs/zfs/zil.c     Tue Jul 12 12:00:31 
2016        (r302659)
+++ vendor-sys/illumos/dist/uts/common/fs/zfs/zil.c     Tue Jul 12 12:01:54 
2016        (r302660)
@@ -1961,7 +1961,7 @@ typedef struct zil_replay_arg {
 static int
 zil_replay_error(zilog_t *zilog, lr_t *lr, int error)
 {
-       char name[MAXNAMELEN];
+       char name[ZFS_MAX_DATASET_NAME_LEN];
 
        zilog->zl_replaying_seq--;      /* didn't actually replay this one */
 

Modified: vendor-sys/illumos/dist/uts/common/sys/fs/zfs.h
==============================================================================
--- vendor-sys/illumos/dist/uts/common/sys/fs/zfs.h     Tue Jul 12 12:00:31 
2016        (r302659)
+++ vendor-sys/illumos/dist/uts/common/sys/fs/zfs.h     Tue Jul 12 12:01:54 
2016        (r302660)
@@ -71,9 +71,13 @@ typedef enum dmu_objset_type {
 #define        ZFS_TYPE_DATASET        \
        (ZFS_TYPE_FILESYSTEM | ZFS_TYPE_VOLUME | ZFS_TYPE_SNAPSHOT)
 
+/*
+ * All of these include the terminating NUL byte.
+ */
 #define        ZAP_MAXNAMELEN 256
 #define        ZAP_MAXVALUELEN (1024 * 8)
 #define        ZAP_OLDMAXVALUELEN 1024
+#define        ZFS_MAX_DATASET_NAME_LEN 256
 
 /*
  * Dataset properties are identified by these constants and must be added to
_______________________________________________
svn-src-all@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/svn-src-all
To unsubscribe, send any mail to "svn-src-all-unsubscr...@freebsd.org"

Reply via email to