diff options
| author | Roman Strashkin <[email protected]> | 2019-03-22 23:11:36 +0300 |
|---|---|---|
| committer | Brian Behlendorf <[email protected]> | 2019-03-22 13:11:36 -0700 |
| commit | 234234ca4de9b2121f69d2cd3b2928197234336d (patch) | |
| tree | d5487ee3847742bc6e60c20227b5c8a5847c551e /module | |
| parent | 2efea7c82c5741a50b476bb1dcbc9a74b8f73ad1 (diff) | |
Panic when running 'zpool split'
Added missing remove of detachable VDEV from txg's DTL list
to avoid use-after-free for the split VDEV
Reviewed by: Pavel Zakharov <[email protected]>
Reviewed-by: Brian Behlendorf <[email protected]>
Reviewed-by: Jorgen Lundman <[email protected]>
Signed-off-by: Roman Strashkin <[email protected]>
Closes #5565
Closes #7856
Diffstat (limited to 'module')
| -rw-r--r-- | module/zfs/spa.c | 12 |
1 files changed, 12 insertions, 0 deletions
diff --git a/module/zfs/spa.c b/module/zfs/spa.c index 9d798ebac..71744139e 100644 --- a/module/zfs/spa.c +++ b/module/zfs/spa.c @@ -6842,6 +6842,18 @@ spa_vdev_split_mirror(spa_t *spa, char *newname, nvlist_t *config, dmu_tx_abort(tx); for (c = 0; c < children; c++) { if (vml[c] != NULL) { + vdev_t *tvd = vml[c]->vdev_top; + + /* + * Need to be sure the detachable VDEV is not + * on any *other* txg's DTL list to prevent it + * from being accessed after it's freed. + */ + for (int t = 0; t < TXG_SIZE; t++) { + (void) txg_list_remove_this( + &tvd->vdev_dtl_list, vml[c], t); + } + vdev_split(vml[c]); if (error == 0) spa_history_log_internal(spa, "detach", tx, |