diff options
| author | George Amanakis <[email protected]> | 2024-07-15 18:07:33 +0200 |
|---|---|---|
| committer | GitHub <[email protected]> | 2024-07-15 09:07:33 -0700 |
| commit | 54ef0fdf60a8e7633c38cb46e1f5bcfcec792f4e (patch) | |
| tree | 4f2884976914df162d9137b4d96a2f84191da1ae /module/zfs/dsl_dataset.c | |
| parent | 2eab4f7b396a1abb9adf7cab82d6ff47f9d78e9b (diff) | |
head_errlog: fix use-after-free
In the commit of the head_errlog feature we introduced a bug in
dsl_dataset_promote_sync(): we may dereference origin_head and hds, both
dereferencing ddpa after calling promote_sync() on ddpa.
Reviewed-by: Brian Behlendorf <[email protected]>
Reviewed-by: Chunwei Chen <[email protected]>
Reviewed-by: Rob Norris <[email protected]>
Reviewed-by: Tony Hutter <[email protected]>
Signed-off-by: George Amanakis <[email protected]>
Closes #16272
Closes #16273
Diffstat (limited to 'module/zfs/dsl_dataset.c')
| -rw-r--r-- | module/zfs/dsl_dataset.c | 7 |
1 files changed, 5 insertions, 2 deletions
diff --git a/module/zfs/dsl_dataset.c b/module/zfs/dsl_dataset.c index d6db61729..94c25e674 100644 --- a/module/zfs/dsl_dataset.c +++ b/module/zfs/dsl_dataset.c @@ -3710,16 +3710,19 @@ dsl_dataset_promote_sync(void *arg, dmu_tx_t *tx) spa_history_log_internal_ds(hds, "promote", tx, " "); dsl_dir_rele(odd, FTAG); - promote_rele(ddpa, FTAG); /* - * Transfer common error blocks from old head to new head. + * Transfer common error blocks from old head to new head, before + * calling promote_rele() on ddpa since we need to dereference + * origin_head and hds. */ if (spa_feature_is_enabled(dp->dp_spa, SPA_FEATURE_HEAD_ERRLOG)) { uint64_t old_head = origin_head->ds_object; uint64_t new_head = hds->ds_object; spa_swap_errlog(dp->dp_spa, new_head, old_head, tx); } + + promote_rele(ddpa, FTAG); } /* |