From 1fef775e7f541c3c6b8285312d705f2f494683ed Mon Sep 17 00:00:00 2001
From: Matthew Dillon <dillon@dragonflybsd.org>
Date: Sun, 1 Jun 2008 01:33:25 +0000
Subject: [PATCH] HAMMER 49B/Many: Stabilization pass

* Fix range checks in the pruning ioctl.

* Fix an incorrect assertion in hammer_vop_strategy_read().
---
 sys/vfs/hammer/hammer_prune.c | 17 +++++++++++++++--
 sys/vfs/hammer/hammer_vnops.c | 17 ++++++++++++-----
 2 files changed, 27 insertions(+), 7 deletions(-)

diff --git a/sys/vfs/hammer/hammer_prune.c b/sys/vfs/hammer/hammer_prune.c
index 3dc3c4d5bc..8c912aff87 100644
--- a/sys/vfs/hammer/hammer_prune.c
+++ b/sys/vfs/hammer/hammer_prune.c
@@ -31,7 +31,7 @@
  * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
  * 
- * $DragonFly: src/sys/vfs/hammer/hammer_prune.c,v 1.3 2008/05/31 18:37:57 dillon Exp $
+ * $DragonFly: src/sys/vfs/hammer/hammer_prune.c,v 1.4 2008/06/01 01:33:25 dillon Exp $
  */
 
 #include "hammer.h"
@@ -65,8 +65,13 @@ hammer_ioc_prune(hammer_transaction_t trans, hammer_inode_t ip,
 
 	if (prune->nelms < 0 || prune->nelms > HAMMER_MAX_PRUNE_ELMS)
 		return(EINVAL);
-	if (prune->beg_obj_id >= prune->end_obj_id)
+	if (prune->beg_localization > prune->end_localization)
 		return(EINVAL);
+	if (prune->beg_localization == prune->end_localization) {
+		if (prune->beg_obj_id > prune->end_obj_id)
+			return(EINVAL);
+		/* key-space limitations - no check needed */
+	}
 	if ((prune->head.flags & HAMMER_IOC_PRUNE_ALL) && prune->nelms)
 		return(EINVAL);
 
@@ -140,6 +145,14 @@ retry:
 		if (prune->stat_oldest_tid > elm->leaf.base.create_tid)
 			prune->stat_oldest_tid = elm->leaf.base.create_tid;
 
+		if (hammer_debug_general & 0x0200) {
+			kprintf("check %016llx %016llx cre=%016llx del=%016llx\n",
+					elm->base.obj_id,
+					elm->base.key,
+					elm->base.create_tid,
+					elm->base.delete_tid);
+		}
+				
 		if (check_prune(prune, elm, &realign_cre, &realign_del) == 0) {
 			if (hammer_debug_general & 0x0200) {
 				kprintf("check %016llx %016llx: DELETE\n",
diff --git a/sys/vfs/hammer/hammer_vnops.c b/sys/vfs/hammer/hammer_vnops.c
index cb695d247b..53c7bbacfe 100644
--- a/sys/vfs/hammer/hammer_vnops.c
+++ b/sys/vfs/hammer/hammer_vnops.c
@@ -31,7 +31,7 @@
  * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
  * 
- * $DragonFly: src/sys/vfs/hammer/hammer_vnops.c,v 1.56 2008/05/25 18:41:33 dillon Exp $
+ * $DragonFly: src/sys/vfs/hammer/hammer_vnops.c,v 1.57 2008/06/01 01:33:25 dillon Exp $
  */
 
 #include <sys/param.h>
@@ -1794,6 +1794,9 @@ hammer_vop_strategy_read(struct vop_strategy_args *ap)
 
 		/*
 		 * Calculate the gap, if any, and zero-fill it.
+		 *
+		 * n is the offset of the start of the record verses our
+		 * current seek offset in the bio.
 		 */
 		n = (int)(rec_offset - (bio->bio_offset + boff));
 		if (n > 0) {
@@ -1808,15 +1811,19 @@ hammer_vop_strategy_read(struct vop_strategy_args *ap)
 		 * Calculate the data offset in the record and the number
 		 * of bytes we can copy.
 		 *
-		 * Note there is a degenerate case here where boff may
-		 * already be at bp->b_bufsize.
+		 * There are two degenerate cases.  First, boff may already
+		 * be at bp->b_bufsize.  Secondly, the data offset within
+		 * the record may exceed the record's size.
 		 */
 		roff = -n;
 		rec_offset += roff;
 		n = cursor.leaf->data_len - roff;
-		KKASSERT(n > 0);
-		if (n > bp->b_bufsize - boff)
+		if (n <= 0) {
+			kprintf("strategy_read: bad n=%d roff=%d\n", n, roff);
+			n = 0;
+		} else if (n > bp->b_bufsize - boff) {
 			n = bp->b_bufsize - boff;
+		}
 
 		/*
 		 * If we cached a truncation point on our front-end the
-- 
2.41.0