mirror of
https://git.proxmox.com/git/mirror_zfs.git
synced 2024-12-25 18:59:33 +03:00
Fix use-after-free in btree code
Coverty static analysis found these. Reviewed-by: Alexander Motin <mav@FreeBSD.org> Reviewed-by: Brian Behlendorf <behlendorf1@llnl.gov> Reviewed-by: Neal Gompa <ngompa@datto.com> Signed-off-by: Richard Yao <richard.yao@alumni.stonybrook.edu> Closes #10989 Closes #13861
This commit is contained in:
parent
0e4c830bc1
commit
13f2b8fb92
@ -1608,8 +1608,8 @@ zfs_btree_remove_from_node(zfs_btree_t *tree, zfs_btree_core_t *node,
|
||||
zfs_btree_poison_node_at(tree, keep_hdr, keep_hdr->bth_count, 1);
|
||||
|
||||
new_rm_hdr->bth_count = 0;
|
||||
zfs_btree_node_destroy(tree, new_rm_hdr);
|
||||
zfs_btree_remove_from_node(tree, parent, new_rm_hdr);
|
||||
zfs_btree_node_destroy(tree, new_rm_hdr);
|
||||
}
|
||||
|
||||
/* Remove the element at the specific location. */
|
||||
@ -1817,10 +1817,10 @@ zfs_btree_remove_idx(zfs_btree_t *tree, zfs_btree_index_t *where)
|
||||
|
||||
/* Move our elements to the left neighbor. */
|
||||
bt_transfer_leaf(tree, rm, 0, rm_hdr->bth_count, keep, k_count + 1);
|
||||
zfs_btree_node_destroy(tree, rm_hdr);
|
||||
|
||||
/* Remove the emptied node from the parent. */
|
||||
zfs_btree_remove_from_node(tree, parent, rm_hdr);
|
||||
zfs_btree_node_destroy(tree, rm_hdr);
|
||||
zfs_btree_verify(tree);
|
||||
}
|
||||
|
||||
|
Loading…
Reference in New Issue
Block a user