From fcd37b622b9fb3a9673b483c59fb2d1a8c368177 Mon Sep 17 00:00:00 2001
From: loli10K <loli10K@users.noreply.github.com>
Date: Mon, 16 Sep 2019 19:46:59 +0200
Subject: Device removal of indirect vdev panics the kernel

This commit fixes a NULL pointer dereference triggered in
spa_vdev_remove_top_check() by trying to "zpool remove" an indirect
vdev.

Reviewed-by: Matt Ahrens <matt@delphix.com>
Reviewed-by: Brian Behlendorf <behlendorf1@llnl.gov>
Signed-off-by: loli10K <ezomori.nozomu@gmail.com>
Closes #9327
---
 module/zfs/vdev_removal.c | 4 ++++
 1 file changed, 4 insertions(+)

(limited to 'module/zfs')

diff --git a/module/zfs/vdev_removal.c b/module/zfs/vdev_removal.c
index 4ce7b559e..549087163 100644
--- a/module/zfs/vdev_removal.c
+++ b/module/zfs/vdev_removal.c
@@ -22,6 +22,7 @@
 /*
  * Copyright (c) 2005, 2010, Oracle and/or its affiliates. All rights reserved.
  * Copyright (c) 2011, 2019 by Delphix. All rights reserved.
+ * Copyright (c) 2019, loli10K <ezomori.nozomu@gmail.com>. All rights reserved.
  */
 
 #include <sys/zfs_context.h>
@@ -1964,6 +1965,9 @@ spa_vdev_remove_top_check(vdev_t *vd)
 	if (vd != vd->vdev_top)
 		return (SET_ERROR(ENOTSUP));
 
+	if (!vdev_is_concrete(vd))
+		return (SET_ERROR(ENOTSUP));
+
 	if (!spa_feature_is_enabled(spa, SPA_FEATURE_DEVICE_REMOVAL))
 		return (SET_ERROR(ENOTSUP));
 
-- 
cgit v1.2.3