Files
mirror_zfs/module/zfs
Richard Yao d954ca19ba Fix theoretical "use-after-free" in dbuf_prefetch_indirect_done()
Coverity complains about a "use-after-free" bug in
`dbuf_prefetch_indirect_done()` because we use a pointer value after
freeing its buffer. The pointer is used for refcounting in ARC (as the
reference holder). There is a theoretical situation where the pointer
would be reused in a way that causes the refcounting to collide, so we
change the order in which we call arc_buf_destroy() and
dbuf_prefetch_fini() to match the rest of the function. This prevents
the theoretical situation from being a possibility.

Also, we have a few return statements with a value, despite this being a
void function. We clean those up while we are making changes here.

Reviewed-by: Alexander Motin <mav@FreeBSD.org>
Reviewed-by: Brian Behlendorf <behlendorf1@llnl.gov>
Reviewed-by: Neal Gompa <ngompa@datto.com>
Signed-off-by: Richard Yao <richard.yao@alumni.stonybrook.edu>
Closes #13869
2022-09-13 17:58:29 -07:00
..
2022-03-15 15:13:42 -07:00
2022-03-15 15:13:42 -07:00
2019-06-19 09:48:12 -07:00
2022-09-12 11:22:15 -07:00
2022-09-02 13:31:19 -07:00
2022-03-15 15:13:42 -07:00
2022-03-15 15:13:42 -07:00
2022-01-07 10:36:49 -08:00
2022-01-12 16:14:36 -08:00
2022-01-26 11:38:52 -08:00
2019-06-19 09:48:12 -07:00
2022-07-11 14:16:13 -07:00
2022-03-15 15:13:42 -07:00
2022-09-13 16:40:10 -07:00
2022-08-02 16:45:30 -07:00
2022-09-02 13:31:19 -07:00
2022-06-29 14:08:59 -07:00