Archive-Team
/
zfs
2
0
Fork 0
Code Issues Pull Requests Packages Projects Releases 103 Wiki Activity

Close possible zfs_znode_held() race 

Check if the lock is held while holding the z_hold_locks() lock.
This prevents a possible use-after-free bug for callers which are
not holding the lock.  There currently are no such callers so this
can't cause a problem today but it has been fixed regardless.

Signed-off-by: Brian Behlendorf <behlendorf1@llnl.gov>
Signed-off-by: Chunwei Chen <tuxoko@gmail.com>
Closes #4244
Issue #4124
This commit is contained in:
Brian Behlendorf 2016-01-19 10:41:21 -08:00
parent 3b9fd93d0b
commit 0a2f95748d
1 changed files with 3 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
module/zfs/zfs_znode.c
View File

@ -248,17 +248,16 @@ zfs_znode_held(zfs_sb_t *zsb, uint64_t obj)
{ {
znode_hold_t *zh, search; znode_hold_t *zh, search;
int i = ZFS_OBJ_HASH(zsb, obj); int i = ZFS_OBJ_HASH(zsb, obj);
boolean_t held;
search.zh_obj = obj; search.zh_obj = obj;
mutex_enter(&zsb->z_hold_locks[i]); mutex_enter(&zsb->z_hold_locks[i]);
zh = avl_find(&zsb->z_hold_trees[i], &search, NULL); zh = avl_find(&zsb->z_hold_trees[i], &search, NULL);
held = (zh && MUTEX_HELD(&zh->zh_lock)) ? B_TRUE : B_FALSE;
mutex_exit(&zsb->z_hold_locks[i]); mutex_exit(&zsb->z_hold_locks[i]);
if (zh && MUTEX_HELD(&zh->zh_lock)) return (held);
return (B_TRUE);
return (B_FALSE);
} }
static znode_hold_t * static znode_hold_t *