Skip to content

Commit

Permalink
abd_return_buf() should call zfs_refcount_remove_many() early
Browse files Browse the repository at this point in the history
Calling zfs_refcount_remove_many() after freeing memory means we pass a
reference to freed memory as the holder. This is not believed to be able
to cause a problem, but there is a bit of a tradition of fixing these
issues when they appear so that they do not obscure more serious issues
in static analyzer output, so we fix this one too.

Clang's static analyzer found this with the help of CodeChecker's CTU
analysis.

Reviewed-by: Brian Behlendorf <[email protected]>
Signed-off-by: Richard Yao <[email protected]>
Closes #14043
ryao authored and behlendorf committed Oct 20, 2022
1 parent c77d2d7 commit d692e6c
Showing 1 changed file with 3 additions and 3 deletions.
6 changes: 3 additions & 3 deletions module/zfs/abd.c
Original file line number Diff line number Diff line change
@@ -667,15 +667,15 @@ abd_return_buf(abd_t *abd, void *buf, size_t n)
{
abd_verify(abd);
ASSERT3U(abd->abd_size, >=, n);
#ifdef ZFS_DEBUG
(void) zfs_refcount_remove_many(&abd->abd_children, n, buf);
#endif
if (abd_is_linear(abd)) {
ASSERT3P(buf, ==, abd_to_buf(abd));
} else {
ASSERT0(abd_cmp_buf(abd, buf, n));
zio_buf_free(buf, n);
}
#ifdef ZFS_DEBUG
(void) zfs_refcount_remove_many(&abd->abd_children, n, buf);
#endif
}

void

0 comments on commit d692e6c

Please sign in to comment.