From 1897bc0d4843e8774189bd7e37a2d6b025dd94cc Mon Sep 17 00:00:00 2001 From: Matthew Ahrens Date: Mon, 31 Oct 2016 10:42:37 -0700 Subject: OpenZFS 9439 - ZFS double-free due to failure to dirty indirect block Follow up commit for OpenZFS 9438. See the OpenZFS-issue link below for a complete analysis. Authored by: Matthew Ahrens Reviewed by: George Wilson Reviewed by: Paul Dagnelie Approved by: Robert Mustacchi Ported-by: Brian Behlendorf OpenZFS-issue: https://illumos.org/issues/9439 OpenZFS-commit: https://github.com/openzfs/openzfs/commit/779220d External-issue: DLPX-46861 Closes #7746 --- module/zfs/dnode_sync.c | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) (limited to 'module/zfs/dnode_sync.c') diff --git a/module/zfs/dnode_sync.c b/module/zfs/dnode_sync.c index 3202faf49..b1f734a82 100644 --- a/module/zfs/dnode_sync.c +++ b/module/zfs/dnode_sync.c @@ -264,6 +264,24 @@ free_children(dmu_buf_impl_t *db, uint64_t blkid, uint64_t nblks, if (db->db_state != DB_CACHED) (void) dbuf_read(db, NULL, DB_RF_MUST_SUCCEED); + /* + * If we modify this indirect block, and we are not freeing the + * dnode (!free_indirects), then this indirect block needs to get + * written to disk by dbuf_write(). If it is dirty, we know it will + * be written (otherwise, we would have incorrect on-disk state + * because the space would be freed but still referenced by the BP + * in this indirect block). Therefore we VERIFY that it is + * dirty. + * + * Our VERIFY covers some cases that do not actually have to be + * dirty, but the open-context code happens to dirty. E.g. if the + * blocks we are freeing are all holes, because in that case, we + * are only freeing part of this indirect block, so it is an + * ancestor of the first or last block to be freed. The first and + * last L1 indirect blocks are always dirtied by dnode_free_range(). + */ + VERIFY(BP_GET_FILL(db->db_blkptr) == 0 || db->db_dirtycnt > 0); + dbuf_release_bp(db); bp = db->db.db_data; -- cgit v1.2.3