From 5c30b24381644a9d1b83d51e813e5e7efba23bc6 Mon Sep 17 00:00:00 2001 From: Alexander Motin Date: Thu, 22 May 2025 10:47:43 -0400 Subject: [PATCH] Fix null dereference in spa_vdev_remove_cancel_sync() We don't really need to access space map to know where the metaslab ends, while msp->ms_sm might be NULL. Reviewed-by: Brian Behlendorf Reviewed-by: Rob Norris Reviewed by: Igor Kozhukhov Signed-off-by: Alexander Motin Sponsored by: iXsystems, Inc. Fixes #17164 Fixes #17359 Closes #17361 --- module/zfs/vdev_removal.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/module/zfs/vdev_removal.c b/module/zfs/vdev_removal.c index 28aae9a31..51d5e4261 100644 --- a/module/zfs/vdev_removal.c +++ b/module/zfs/vdev_removal.c @@ -1931,10 +1931,9 @@ spa_vdev_remove_cancel_sync(void *arg, dmu_tx_t *tx) * because we have not allocated mappings for it yet. */ uint64_t syncd = vdev_indirect_mapping_max_offset(vim); - uint64_t sm_end = msp->ms_sm->sm_start + - msp->ms_sm->sm_size; - if (sm_end > syncd) - zfs_range_tree_clear(segs, syncd, sm_end - syncd); + uint64_t ms_end = msp->ms_start + msp->ms_size; + if (ms_end > syncd) + zfs_range_tree_clear(segs, syncd, ms_end - syncd); zfs_range_tree_vacate(segs, free_mapped_segment_cb, vd); }