hardenedbsd/HardenedBSD
1
0
Fork 0
mirror of https://git.hardenedbsd.org/hardenedbsd/HardenedBSD.git synced 2024-11-24 01:07:21 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity

HBSD: Bring in OpenZFS commit c87cb22ba9

Browse Source 
head_errlog: fix use-after-free

In the commit of the head_errlog feature we introduced a bug in
dsl_dataset_promote_sync(): we may dereference origin_head and hds, both
dereferencing ddpa after calling promote_sync() on ddpa.

Signed-off-by:	Shawn Webb <shawn.webb@hardenedbsd.org>
Obtained-from:	c87cb22ba9.patch
MFC-to:		14-STABLE
MFC-to:		13-STABLE
This commit is contained in:
Shawn Webb 2024-07-15 23:34:25 +00:00
parent 787c47b575
commit 57c8474aaf
No known key found for this signature in database
1 changed files with 5 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
sys/contrib/openzfs/module/zfs/dsl_dataset.c
View File

@ -3712,16 +3712,19 @@ dsl_dataset_promote_sync(void *arg, dmu_tx_t *tx)
spa_history_log_internal_ds(hds, "promote", tx, " ");
dsl_dir_rele(odd, FTAG);
promote_rele(ddpa, FTAG);
/*
* Transfer common error blocks from old head to new head.
* Transfer common error blocks from old head to new head, before
* calling promote_rele() on ddpa since we need to dereference
* origin_head and hds.
*/
if (spa_feature_is_enabled(dp->dp_spa, SPA_FEATURE_HEAD_ERRLOG)) {
uint64_t old_head = origin_head->ds_object;
uint64_t new_head = hds->ds_object;
spa_swap_errlog(dp->dp_spa, new_head, old_head, tx);
}
promote_rele(ddpa, FTAG);
}
/*