DF-5151 / fix.diff
diff --git a/sys/dev/disk/dm/dm_pdev.c b/sys/dev/disk/dm/dm_pdev.c index 8c429e4e..1f6975be 100644 --- a/sys/dev/disk/dm/dm_pdev.c +++ b/sys/dev/disk/dm/dm_pdev.c @@ -125,6 +125,21 @@ dm_pdev_insert(const char *dev_name) KKASSERT(dev_name != NULL); + /* + * The pdev is keyed by name in a fixed DM_MAX_DEV_NAME (32) byte + * field. A longer path used to be silently truncated by + * dm_pdev_alloc()'s strlcpy, which corrupts the dedup key: a later + * insert whose path equals the truncated prefix strcmp-matches and + * silently reuses this pdev, binding the new table to the WRONG + * physical device. Long paths also created duplicate pdev entries + * under the same truncated key. Reject them loudly instead. + */ + if (strlen(dev_name) >= DM_MAX_DEV_NAME) { + kprintf("dm_pdev_insert: device path too long (max %d): %s\n", + DM_MAX_DEV_NAME - 1, dev_name); + return NULL; + } + lockmgr(&dm_pdev_mutex, LK_EXCLUSIVE); dmp = dm_pdev_lookup_name(dev_name); |