| commit | 7dc2baaa1f18953c7ecb4daef98d14a3201f95d6 | |
| author | Alexander Motin <mav@FreeBSD.org> | |
| Sat, 2 Sep 2023 00:13:52 +0000 (1 20:13 -0400) | ||
| committer | Brian Behlendorf <behlendorf1@llnl.gov> | |
| Sat, 2 Sep 2023 17:30:38 +0000 (2 10:30 -0700) | ||
| tree | 8b6b30d9b1663707c3d7f6c92f1fb2fd390cb2a0 | treesnapshot (tar.gz zip) |
| parent | 5a7cb0b06578688bb80ad739f3b3ac4f1492b1fa | commitdiff |
ZIL: Revert zl_lock scope reduction.
While I have no reports of it, I suspect possible use-after-free
scenario when zil_commit_waiter() tries to dereference zcw_lwb
for lwb already freed by zil_sync(), while zcw_done is not set.
Extension of zl_lock scope as it was originally should block
zil_sync() from freeing the lwb, closing this race.
This reverts #14959 and couple chunks of #14841.
Reviewed-by: Brian Behlendorf <behlendorf1@llnl.gov>
Signed-off-by: Alexander Motin <mav@FreeBSD.org>
Sponsored by: iXsystems, Inc.
Closes #15228
While I have no reports of it, I suspect possible use-after-free
scenario when zil_commit_waiter() tries to dereference zcw_lwb
for lwb already freed by zil_sync(), while zcw_done is not set.
Extension of zl_lock scope as it was originally should block
zil_sync() from freeing the lwb, closing this race.
This reverts #14959 and couple chunks of #14841.
Reviewed-by: Brian Behlendorf <behlendorf1@llnl.gov>
Signed-off-by: Alexander Motin <mav@FreeBSD.org>
Sponsored by: iXsystems, Inc.
Closes #15228
| module/zfs/zil.c | diffblobblamehistory |