HomeFreeBSD

Fix unprotected zfs_znode_dmu_fini

Description

Fix unprotected zfs_znode_dmu_fini

In original code, zfs_znode_dmu_fini is called in zfs_rmnode without
zfs_znode_hold_enter. It seems to assume it's ok to do so when the znode
is unlinked. However this assumption is not correct, as zfs_zget can be
called by NFS through zpl_fh_to_dentry as pointed out by Christian in
https://github.com/openzfs/zfs/pull/12767, which could result in a
use-after-free bug.

Reviewed-by: Brian Behlendorf <behlendorf1@llnl.gov>
Co-authored-by: Ryan Moeller <ryan@iXsystems.com>
Signed-off-by: Chunwei Chen <david.chen@nutanix.com>
Signed-off-by: Ryan Moeller <ryan@iXsystems.com>
Closes #12767
Closes #14364

Details

Provenance
Chunwei Chen <tuxoko@gmail.com>Authored on Jan 20 2023, 12:59 AM
GitHub <noreply@github.com>Committed on Jan 20 2023, 12:59 AM
Parents
rGa379083d9f2b: Man: fix defaults for zfs_dirty_data_max_max
Branches
Unknown
Tags
Unknown

Event Timeline

GitHub <noreply@github.com> committed rGc6dab6dd3921: Fix unprotected zfs_znode_dmu_fini (authored by Chunwei Chen <tuxoko@gmail.com>).Jan 20 2023, 12:59 AM