diff options
| author | Richard Yao <[email protected]> | 2022-09-12 14:22:15 -0400 |
|---|---|---|
| committer | Tony Hutter <[email protected]> | 2022-09-13 16:15:38 -0700 |
| commit | 8131a96544fd19411c23424af85140e91e41c001 (patch) | |
| tree | 3548a5f1db4469d521038c0cd9372507ce18f36a /module | |
| parent | 979fd5a434ebc422c02dec5deddd485ce6127fc5 (diff) | |
Fix use-after-free in btree code
Coverty static analysis found these.
Reviewed-by: Alexander Motin <[email protected]>
Reviewed-by: Brian Behlendorf <[email protected]>
Reviewed-by: Neal Gompa <[email protected]>
Signed-off-by: Richard Yao <[email protected]>
Closes #10989
Closes #13861
Diffstat (limited to 'module')
| -rw-r--r-- | module/zfs/btree.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/module/zfs/btree.c b/module/zfs/btree.c index 03c46473c..36755f979 100644 --- a/module/zfs/btree.c +++ b/module/zfs/btree.c @@ -1608,8 +1608,8 @@ zfs_btree_remove_from_node(zfs_btree_t *tree, zfs_btree_core_t *node, zfs_btree_poison_node_at(tree, keep_hdr, keep_hdr->bth_count, 1); new_rm_hdr->bth_count = 0; - zfs_btree_node_destroy(tree, new_rm_hdr); zfs_btree_remove_from_node(tree, parent, new_rm_hdr); + zfs_btree_node_destroy(tree, new_rm_hdr); } /* Remove the element at the specific location. */ @@ -1817,10 +1817,10 @@ zfs_btree_remove_idx(zfs_btree_t *tree, zfs_btree_index_t *where) /* Move our elements to the left neighbor. */ bt_transfer_leaf(tree, rm, 0, rm_hdr->bth_count, keep, k_count + 1); - zfs_btree_node_destroy(tree, rm_hdr); /* Remove the emptied node from the parent. */ zfs_btree_remove_from_node(tree, parent, rm_hdr); + zfs_btree_node_destroy(tree, rm_hdr); zfs_btree_verify(tree); } |