Lock db_mtx around arc_release() in couple places

* Lock db_mtx around arc_release() in dbuf_release_bp()

While this function is called only in sync context, the same buffer
can be touched by dbuf_hold_impl() in open context, creating races.
All other accesses to arc_release() are already protected by db_mtx,
so just take it here too.

Signed-off-by: Alexander Motin <alexander.motin@TrueNAS.com>

* Lock db_mtx in sa_byteswap()

While SA code seems protected by sa_lock, there is a back door of
dmu_objset_userquota_get_ids(), that may hold and access the dbuf
without sa_lock, relying only on db_mtx. Taking db_mtx here should
protect both the arc_release() and the data for db_buf.

Reviewed-by: Brian Behlendorf <behlendorf1@llnl.gov>
Reviewed-by: Ameer Hamza <ahamza@ixsystems.com>
Signed-off-by: Alexander Motin <alexander.motin@TrueNAS.com>
Closes #18146
This commit is contained in:
Alexander Motin
2026-01-26 21:32:16 -05:00
committed by GitHub
parent cd895f0e57
commit 35b2d39709
2 changed files with 13 additions and 4 deletions
+2
View File
@@ -2137,7 +2137,9 @@ dbuf_release_bp(dmu_buf_impl_t *db)
list_link_active(&os->os_dsl_dataset->ds_synced_link));
ASSERT(db->db_parent == NULL || arc_released(db->db_parent->db_buf));
mutex_enter(&db->db_mtx);
(void) arc_release(db->db_buf, db);
mutex_exit(&db->db_mtx);
}
/*