c/mirror_zfs
1
0
Fork 0
mirror of https://git.proxmox.com/git/mirror_zfs.git synced 2024-11-17 18:11:00 +03:00
Code Issues Packages Projects Releases Wiki Activity

Revert "Fixed a use-after-free bug in zfs_zget()."

Browse Source 
This reverts commit 36df284366.

Signed-off-by: Brian Behlendorf <behlendorf1@llnl.gov>
This commit is contained in:
Brian Behlendorf 2014-04-03 14:26:16 -07:00
parent 7c05c6185b
commit 8ac67298b1
1 changed files with 1 additions and 23 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

24
module/zfs/zfs_znode.c
View File

@ -859,19 +859,14 @@ zfs_zget(zfs_sb_t *zsb, uint64_t obj_num, znode_t **zpp)
znode_t *zp; znode_t *zp;
int err; int err;
sa_handle_t *hdl; sa_handle_t *hdl;
struct inode *ip;
*zpp = NULL; *zpp = NULL;
again:
ip = ilookup(zsb->z_sb, obj_num);
ZFS_OBJ_HOLD_ENTER(zsb, obj_num); ZFS_OBJ_HOLD_ENTER(zsb, obj_num);
err = sa_buf_hold(zsb->z_os, obj_num, NULL, &db); err = sa_buf_hold(zsb->z_os, obj_num, NULL, &db);
if (err) { if (err) {
ZFS_OBJ_HOLD_EXIT(zsb, obj_num); ZFS_OBJ_HOLD_EXIT(zsb, obj_num);
iput(ip);
return (err); return (err);
} }
@ -882,28 +877,14 @@ again:
doi.doi_bonus_size < sizeof (znode_phys_t)))) { doi.doi_bonus_size < sizeof (znode_phys_t)))) {
sa_buf_rele(db, NULL); sa_buf_rele(db, NULL);
ZFS_OBJ_HOLD_EXIT(zsb, obj_num); ZFS_OBJ_HOLD_EXIT(zsb, obj_num);
iput(ip);
return (SET_ERROR(EINVAL)); return (SET_ERROR(EINVAL));
} }
hdl = dmu_buf_get_user(db); hdl = dmu_buf_get_user(db);
if (hdl != NULL) { if (hdl != NULL) {
if (ip == NULL) {
/*
* ilookup returned NULL, which means
* the znode is dying - but the SA handle isn't
* quite dead yet, we need to drop any locks
* we're holding, re-schedule the task and try again.
*/
sa_buf_rele(db, NULL);
ZFS_OBJ_HOLD_EXIT(zsb, obj_num);
schedule();
goto again;
}
zp = sa_get_userdata(hdl); zp = sa_get_userdata(hdl);
/* /*
* Since "SA" does immediate eviction we * Since "SA" does immediate eviction we
* should never find a sa handle that doesn't * should never find a sa handle that doesn't
@ -924,12 +905,9 @@ again:
sa_buf_rele(db, NULL); sa_buf_rele(db, NULL);
mutex_exit(&zp->z_lock); mutex_exit(&zp->z_lock);
ZFS_OBJ_HOLD_EXIT(zsb, obj_num); ZFS_OBJ_HOLD_EXIT(zsb, obj_num);
iput(ip);
return (err); return (err);
} }
ASSERT3P(ip, ==, NULL);
/* /*
* Not found create new znode/vnode but only if file exists. * Not found create new znode/vnode but only if file exists.
* *