diff options
| author | Mark Johnston <[email protected]> | 2024-01-09 10:57:29 -0500 |
|---|---|---|
| committer | Brian Behlendorf <[email protected]> | 2024-01-29 14:53:29 -0800 |
| commit | 22e4f08c30f97d208a6d1ae8b8943071de340431 (patch) | |
| tree | 65f4067d1d2b621bf494eb39bd63d15debfa6e14 | |
| parent | 7bccf98a731d717515ba83f728be337e2b21b9bc (diff) | |
Linux: Defer loading the object set in zfs_setattr()
We need to wait until after having done a zfs_enter() to load some
fields from the zfsvfs structure. Otherwise a use-after-free is
possible in the face of a concurrent rollback.
Other functions in this file are careful to avoid this bug, I believe
this is the only instance.
Reviewed-by: Brian Atkinson <[email protected]>
Reviewed-by: Brian Behlendorf <[email protected]>
Signed-off-by: Mark Johnston <[email protected]>
Closes #15752
| -rw-r--r-- | module/os/linux/zfs/zfs_vnops_os.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/module/os/linux/zfs/zfs_vnops_os.c b/module/os/linux/zfs/zfs_vnops_os.c index 9ea8ad5f4..ecfa4b54e 100644 --- a/module/os/linux/zfs/zfs_vnops_os.c +++ b/module/os/linux/zfs/zfs_vnops_os.c @@ -1853,7 +1853,7 @@ zfs_setattr(znode_t *zp, vattr_t *vap, int flags, cred_t *cr, zidmap_t *mnt_ns) { struct inode *ip; zfsvfs_t *zfsvfs = ZTOZSB(zp); - objset_t *os = zfsvfs->z_os; + objset_t *os; zilog_t *zilog; dmu_tx_t *tx; vattr_t oldva; @@ -1885,6 +1885,7 @@ zfs_setattr(znode_t *zp, vattr_t *vap, int flags, cred_t *cr, zidmap_t *mnt_ns) if ((err = zfs_enter_verify_zp(zfsvfs, zp, FTAG)) != 0) return (err); ip = ZTOI(zp); + os = zfsvfs->z_os; /* * If this is a xvattr_t, then get a pointer to the structure of |