Hi.

I believe zvol_minor_lookup() can return wrong zvol in very rare case:

static zvol_state_t *
zvol_minor_lookup(const char *name)
{
        minor_t minor;
        zvol_state_t *zv;

        ASSERT(MUTEX_HELD(&zvol_state_lock));

        for (minor = 1; minor <= ZVOL_MAX_MINOR; minor++) {
                zv = ddi_get_soft_state(zvol_state, minor);
                if (zv == NULL)
                        continue;
                if (strcmp(zv->zv_name, name) == 0)
                        break;
        }

        return (zv);
}

If there is zvol for minor == ZVOL_MAX_MINOR, this zvol will be returned
no matter if the name matches or not.

Simple patch to correct that is here:

        http://people.freebsd.org/~pjd/patches/zvol.c.2.patch

-- 
Pawel Jakub Dawidek                       http://www.wheelsystems.com
pjd at FreeBSD.org                           http://www.FreeBSD.org
FreeBSD committer                         Am I Evil? Yes, I Am!
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 196 bytes
Desc: not available
URL: 
<http://mail.opensolaris.org/pipermail/zfs-code/attachments/20100317/45adc532/attachment.bin>

Reply via email to