From 9e2be2dfbde6c41ff53d71f3669cb6b9909c5a40 Mon Sep 17 00:00:00 2001 From: Richard Yao Date: Thu, 10 Nov 2022 09:01:58 -0500 Subject: [PATCH] Fix potential NULL pointer dereference regression 945b407486a0072ec7dd117a0bde2f72d52eb445 neglected to `NULL` check `tx->tx_objset`, which is already done in the function. This upset Coverity, which complained about a "dereference after null check". Upon inspection, it was found that whenever `dmu_tx_create_dd()` is called followed by `dmu_tx_assign()`, such as in `dsl_sync_task_common()`, `tx->tx_objset` will be `NULL`. Reported-by: Coverity (CID 1527261) Reviewed-by: Mariusz Zaborski Reviewed-by: Youzhong Yang Signed-off-by: Richard Yao Closes #14170 --- module/zfs/dsl_dir.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/module/zfs/dsl_dir.c b/module/zfs/dsl_dir.c index 486f50108b..c1afaa6aaf 100644 --- a/module/zfs/dsl_dir.c +++ b/module/zfs/dsl_dir.c @@ -1321,7 +1321,7 @@ top_of_function: * we want to let it through. */ if (ignorequota || netfree || dsl_dir_phys(dd)->dd_quota == 0 || - (dmu_objset_type(tx->tx_objset) == DMU_OST_ZVOL && + (tx->tx_objset && dmu_objset_type(tx->tx_objset) == DMU_OST_ZVOL && zvol_enforce_quotas == B_FALSE)) quota = UINT64_MAX; else