From 24a6d8316a162cb28b49f59d98c0554d14660b00 Mon Sep 17 00:00:00 2001 From: Richard Yao Date: Sun, 4 Dec 2022 16:31:28 -0500 Subject: [PATCH] Fix dereference after null check in enqueue_range If the bp is NULL, we have a hole. However, when we build with assertions, we will dereference bp when `blkid == DMU_SPILL_BLKID`. When this happens on a hole, we will have a NULL pointer dereference. Reported-by: Coverity (CID-1524670) Reviewed-by: Damian Szuberski Reviewed-by: Alexander Motin Reviewed-by: Brian Behlendorf Signed-off-by: Richard Yao Closes #14264 --- module/zfs/dmu_send.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/module/zfs/dmu_send.c b/module/zfs/dmu_send.c index 20ec4ac173..0715a8c302 100644 --- a/module/zfs/dmu_send.c +++ b/module/zfs/dmu_send.c @@ -1714,8 +1714,10 @@ enqueue_range(struct send_reader_thread_arg *srta, bqueue_t *q, dnode_t *dn, struct send_range *range = range_alloc(range_type, dn->dn_object, blkid, blkid + count, B_FALSE); - if (blkid == DMU_SPILL_BLKID) + if (blkid == DMU_SPILL_BLKID) { + ASSERT3P(bp, !=, NULL); ASSERT3U(BP_GET_TYPE(bp), ==, DMU_OT_SA); + } switch (range_type) { case HOLE: