Skip to content

head_errlog: fix use-after-free #16273

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Jul 15, 2024
Merged

Conversation

gamanakis
Copy link
Contributor

@gamanakis gamanakis commented Jun 16, 2024

Motivation and Context

In the commit of the head_errlog feature we introduced a bug in dsl_dataset_promote_sync(): we may dereference origin_head and hds, both dereferencing ddpa after calling promote_sync() on ddpa.

Closes: #16272

Description

Call promote_sync() on ddpa after calling spa_swap_errlog().

How Has This Been Tested?

Types of changes

  • Bug fix (non-breaking change which fixes an issue)
  • New feature (non-breaking change which adds functionality)
  • Performance enhancement (non-breaking change which improves efficiency)
  • Code cleanup (non-breaking change which makes code smaller or more readable)
  • Breaking change (fix or feature that would cause existing functionality to change)
  • Library ABI change (libzfs, libzfs_core, libnvpair, libuutil and libzfsbootenv)
  • Documentation (a change to man pages or other documentation)

Checklist:

@gamanakis gamanakis marked this pull request as ready for review June 17, 2024 05:57
Copy link
Contributor

@tuxoko tuxoko left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good. This should also fix #15531

Copy link
Contributor

@tonyhutter tonyhutter left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good. I think your commit message might need a # before the issue number in:

Closes: 16272

@gamanakis
Copy link
Contributor Author

Looks good. I think your commit message might need a # before the issue number in:

Closes: 16272

Done!

@tonyhutter
Copy link
Contributor

I think this is basically good to go. Can you rebase on master to kick off buildbot again? We had some recent ZTS fixes that got merged that might help with the F39-40 failures you're seeing.

@behlendorf behlendorf added the Status: Accepted Ready to integrate (reviewed, tested) label Jul 12, 2024
In the commit of the head_errlog feature we introduced a bug in
dsl_dataset_promote_sync(): we may dereference origin_head and hds, both
dereferencing ddpa after calling promote_sync() on ddpa.

Closes: openzfs#16272

Signed-off-by: George Amanakis <[email protected]>
@gamanakis
Copy link
Contributor Author

914bbc9: rebased to master

@behlendorf behlendorf merged commit c87cb22 into openzfs:master Jul 15, 2024
22 of 25 checks passed
behlendorf pushed a commit that referenced this pull request Jul 15, 2024
In the commit of the head_errlog feature we introduced a bug in
dsl_dataset_promote_sync(): we may dereference origin_head and hds, both
dereferencing ddpa after calling promote_sync() on ddpa.

Reviewed-by: Brian Behlendorf <[email protected]>
Reviewed-by: Chunwei Chen <[email protected]>
Reviewed-by: Rob Norris <[email protected]>
Reviewed-by: Tony Hutter <[email protected]>
Signed-off-by: George Amanakis <[email protected]>
Closes #16272
Closes #16273
calccrypto pushed a commit to hpc/zfs that referenced this pull request Jul 17, 2024
In the commit of the head_errlog feature we introduced a bug in
dsl_dataset_promote_sync(): we may dereference origin_head and hds, both
dereferencing ddpa after calling promote_sync() on ddpa.

Reviewed-by: Brian Behlendorf <[email protected]>
Reviewed-by: Chunwei Chen <[email protected]>
Reviewed-by: Rob Norris <[email protected]>
Reviewed-by: Tony Hutter <[email protected]>
Signed-off-by: George Amanakis <[email protected]>
Closes openzfs#16272
Closes openzfs#16273
ptr1337 pushed a commit to CachyOS/zfs that referenced this pull request Aug 4, 2024
In the commit of the head_errlog feature we introduced a bug in
dsl_dataset_promote_sync(): we may dereference origin_head and hds, both
dereferencing ddpa after calling promote_sync() on ddpa.

Reviewed-by: Brian Behlendorf <[email protected]>
Reviewed-by: Chunwei Chen <[email protected]>
Reviewed-by: Rob Norris <[email protected]>
Reviewed-by: Tony Hutter <[email protected]>
Signed-off-by: George Amanakis <[email protected]>
Closes openzfs#16272
Closes openzfs#16273
lundman pushed a commit to openzfsonwindows/openzfs that referenced this pull request Sep 4, 2024
In the commit of the head_errlog feature we introduced a bug in
dsl_dataset_promote_sync(): we may dereference origin_head and hds, both
dereferencing ddpa after calling promote_sync() on ddpa.

Reviewed-by: Brian Behlendorf <[email protected]>
Reviewed-by: Chunwei Chen <[email protected]>
Reviewed-by: Rob Norris <[email protected]>
Reviewed-by: Tony Hutter <[email protected]>
Signed-off-by: George Amanakis <[email protected]>
Closes openzfs#16272
Closes openzfs#16273
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Status: Accepted Ready to integrate (reviewed, tested)
Projects
None yet
Development

Successfully merging this pull request may close these issues.

use-after-free in dsl_dataset_promote_sync()
5 participants