diff options
| author | Boris Protopopov <[email protected]> | 2013-08-30 12:12:45 -0700 |
|---|---|---|
| committer | Brian Behlendorf <[email protected]> | 2014-03-10 09:11:15 -0700 |
| commit | 47fe91b54c9c2d844059d50cb9622d7bbde9da27 (patch) | |
| tree | 2b580f17c4b8914ea4296d638ffc6f5cefc12f34 | |
| parent | a45fc6a677bee01c0461b848e6e47ac3cb7797df (diff) | |
Illumos #4088 use after free in arc_release()
4088 use after free in arc_release()
Reviewed by: Matthew Ahrens <[email protected]>
Reviewed by: Garrett D'Amore <[email protected]>
Reviewed by: Saso Kiselkov <[email protected]>
Approved by: Dan McDonald <[email protected]>
References:
https://www.illumos.org/issues/4088
illumos/illumos-gate@ccc22e130479b5bd7c0002267fee1e0602d3f772
From the illumos issue:
A race-induced use after free occurs in arc_release() where the
ARC header is used outside the critical section protected by the
hash_lock.
Ported by: Tim Chase <[email protected]>
Signed-off-by: Brian Behlendorf <[email protected]>
Signed-off-by: Richard Yao <[email protected]>
Closes #2162
| -rw-r--r-- | module/zfs/arc.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/module/zfs/arc.c b/module/zfs/arc.c index ccc9510fd..59e6c5bc8 100644 --- a/module/zfs/arc.c +++ b/module/zfs/arc.c @@ -3665,6 +3665,7 @@ arc_release(arc_buf_t *buf, void *tag) if (l2hdr) { mutex_enter(&l2arc_buflist_mtx); hdr->b_l2hdr = NULL; + list_remove(l2hdr->b_dev->l2ad_buflist, hdr); } buf_size = hdr->b_size; @@ -3758,7 +3759,6 @@ arc_release(arc_buf_t *buf, void *tag) if (l2hdr) { ARCSTAT_INCR(arcstat_l2_asize, -l2hdr->b_asize); - list_remove(l2hdr->b_dev->l2ad_buflist, hdr); kmem_cache_free(l2arc_hdr_cache, l2hdr); arc_space_return(L2HDR_SIZE, ARC_SPACE_L2HDRS); ARCSTAT_INCR(arcstat_l2_size, -buf_size); |