Fix dbuf_stats_hash_table_data race

Dropping DBUF_HASH_MUTEX when walking the hash list is unsafe. The dbuf can be freed at any time. Signed-off-by: Chunwei Chen <[email protected]> Signed-off-by: Brian Behlendorf <[email protected]> Closes #4846
openzfs · Jul 14, 2016 · 02de3e3 · 02de3e3
1 parent 8887c7d
commit 02de3e3
Showing 1 changed file with 0 additions and 2 deletions.
diff --git a/module/zfs/dbuf_stats.c b/module/zfs/dbuf_stats.c
@@ -148,7 +148,6 @@ dbuf_stats_hash_table_data(char *buf, size_t size, void *data)
 		}
 
 		mutex_enter(&db->db_mtx);
-		mutex_exit(DBUF_HASH_MUTEX(h, dsh->idx));
 
 		if (db->db_state != DB_EVICTING) {
 			length = __dbuf_stats_hash_table_data(buf, size, db);
@@ -157,7 +156,6 @@ dbuf_stats_hash_table_data(char *buf, size_t size, void *data)
 		}
 
 		mutex_exit(&db->db_mtx);
-		mutex_enter(DBUF_HASH_MUTEX(h, dsh->idx));
 	}
 	mutex_exit(DBUF_HASH_MUTEX(h, dsh->idx));