Author: avg
Date: Mon Nov 25 17:19:05 2013
New Revision: 258565
URL: http://svnweb.freebsd.org/changeset/base/258565
Log:
MFV r258377: 4088 use after free in arc_release()
illumos/illumos-gate@ccc22e130479b5bd7c0002267fee1e0602d3f772
Approved by: re (gjb)
Modified:
stable/10/sys/cddl/contrib/opensolaris/uts/common/fs/zfs/arc.c
Directory Properties:
stable/10/sys/ (props changed)
stable/10/sys/cddl/contrib/opensolaris/ (props changed)
Modified: stable/10/sys/cddl/contrib/opensolaris/uts/common/fs/zfs/arc.c
==============================================================================
--- stable/10/sys/cddl/contrib/opensolaris/uts/common/fs/zfs/arc.c Mon Nov
25 16:44:02 2013 (r258564)
+++ stable/10/sys/cddl/contrib/opensolaris/uts/common/fs/zfs/arc.c Mon Nov
25 17:19:05 2013 (r258565)
@@ -3540,6 +3540,7 @@ arc_release(arc_buf_t *buf, void *tag)
if (l2hdr) {
mutex_enter(&l2arc_buflist_mtx);
hdr->b_l2hdr = NULL;
+ list_remove(l2hdr->b_dev->l2ad_buflist, hdr);
}
buf_size = hdr->b_size;
@@ -3627,7 +3628,6 @@ arc_release(arc_buf_t *buf, void *tag)
ARCSTAT_INCR(arcstat_l2_asize, -l2hdr->b_asize);
trim_map_free(l2hdr->b_dev->l2ad_vdev, l2hdr->b_daddr,
hdr->b_size, 0);
- list_remove(l2hdr->b_dev->l2ad_buflist, hdr);
kmem_free(l2hdr, sizeof (l2arc_buf_hdr_t));
ARCSTAT_INCR(arcstat_l2_size, -buf_size);
mutex_exit(&l2arc_buflist_mtx);
_______________________________________________
svn-src-all@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/svn-src-all
To unsubscribe, send any mail to "svn-src-all-unsubscr...@freebsd.org"
