Possible bug in traverse_visitbp #2060
Milestone
Comments
|
@tuxoko I suspect your right. I'd have expected the TRAVERSE_PRE and TRAVERSE_POST calls to pass the same We'll certainly not want to loose take of this and take a closer look. Thanks for filing an issue. |
|
Could this be the same issue? ii dkms 2.2.0.3-1.1ubuntu4+zfs1 uname -aLinux v302 3.11.0-15-generic #25-Ubuntu SMP Thu Jan 30 17:22:01 UTC 2014 x86_64 x86_64 x86_64 GNU/Linux |
|
I just deadlocked Interestingly, backup_cb appears in the stack trace: |
|
@ryao So we might want to just "fixed" this and close this issue. |
|
Closing. For the reason described in the previous comment. |
|
@behlendorf |
behlendorf
pushed a commit
to behlendorf/zfs
that referenced
this issue
Apr 28, 2015
In traverse_visitbp(), the input argument dnp is modified in the middle to point to a temporary buffer. Originally this doesn't matter, because no user of TRAVERSE_POST dereferences it. However, in fbeddd6 a piece of code is added dereferencing dnp after the modification, creating a possible bug. We fix this by creating a new local variable cdnp for the DMU_OT_DNODE case, so we don't modify the input argument. Also we introduce different local variables in the DMU_OT_OBJSET case to prevent confusion between the input argument. Signed-off-by: Chunwei Chen <tuxoko@gmail.com> Signed-off-by: Richard Yao <ryao@gentoo.org> Signed-off-by: Tim Chase <tim@chase2k.com> Signed-off-by: Brian Behlendorf <behlendorf1@llnl.gov> Closes openzfs#2060
dasjoe
pushed a commit
to dasjoe/zfs
that referenced
this issue
May 24, 2015
In traverse_visitbp(), the input argument dnp is modified in the middle to point to a temporary buffer. Originally this doesn't matter, because no user of TRAVERSE_POST dereferences it. However, in fbeddd6 a piece of code is added dereferencing dnp after the modification, creating a possible bug. We fix this by creating a new local variable cdnp for the DMU_OT_DNODE case, so we don't modify the input argument. Also we introduce different local variables in the DMU_OT_OBJSET case to prevent confusion between the input argument. Signed-off-by: Chunwei Chen <tuxoko@gmail.com> Signed-off-by: Richard Yao <ryao@gentoo.org> Signed-off-by: Tim Chase <tim@chase2k.com> Signed-off-by: Brian Behlendorf <behlendorf1@llnl.gov> Closes openzfs#2060
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Hi all:
dmu_traverse.c L306:
dnp = buf->b_data;It modifies the input argument
dnp.and
dmu_traverse.c L367:
(void) arc_buf_remove_ref(buf, &buf);dnpnow becomes possible dangling pointer.and later
dmu_traverse.c L371:
err = td->td_func(td->td_spa, NULL, bp, zb, dnp, td->td_arg);dnpis accessed again.This seems to be a bug to me.
Any comment?
The text was updated successfully, but these errors were encountered: