From 18ae26747cea5e21748ff1eb928c3a089d29af9b Mon Sep 17 00:00:00 2001 From: Richard Yao Date: Mon, 12 Sep 2022 14:22:15 -0400 Subject: [PATCH] Fix use-after-free in btree code Coverty static analysis found these. Reviewed-by: Alexander Motin Reviewed-by: Brian Behlendorf Reviewed-by: Neal Gompa Signed-off-by: Richard Yao Closes #10989 Closes #13861 (cherry picked from commit 13f2b8fb92c23090b9f6e701c8471aef6b8e917b) --- module/zfs/btree.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/module/zfs/btree.c b/module/zfs/btree.c index 57b9dbbb2b50..77cb2543e93d 100644 --- a/module/zfs/btree.c +++ b/module/zfs/btree.c @@ -1536,8 +1536,8 @@ zfs_btree_remove_from_node(zfs_btree_t *tree, zfs_btree_core_t *node, zfs_btree_poison_node_at(tree, keep_hdr, keep_hdr->bth_count); new_rm_hdr->bth_count = 0; - zfs_btree_node_destroy(tree, new_rm_hdr); zfs_btree_remove_from_node(tree, parent, new_rm_hdr); + zfs_btree_node_destroy(tree, new_rm_hdr); } /* Remove the element at the specific location. */ @@ -1769,6 +1769,7 @@ zfs_btree_remove_idx(zfs_btree_t *tree, zfs_btree_index_t *where) zfs_btree_node_destroy(tree, rm_hdr); /* Remove the emptied node from the parent. */ zfs_btree_remove_from_node(tree, parent, rm_hdr); + zfs_btree_node_destroy(tree, rm_hdr); zfs_btree_verify(tree); }