Added missing remove of detachable VDEV from txg's DTL list
to avoid use-after-free for the split VDEV
Reviewed by: Pavel Zakharov <pavel.zakharov@delphix.com>
Reviewed-by: Brian Behlendorf <behlendorf1@llnl.gov>
Reviewed-by: Jorgen Lundman <lundman@lundman.net>
Signed-off-by: Roman Strashkin <roman.strashkin@nexenta.com>
Closes #5565
Closes #7856
dmu_tx_abort(tx);
for (c = 0; c < children; c++) {
if (vml[c] != NULL) {
+ vdev_t *tvd = vml[c]->vdev_top;
+
+ /*
+ * Need to be sure the detachable VDEV is not
+ * on any *other* txg's DTL list to prevent it
+ * from being accessed after it's freed.
+ */
+ for (int t = 0; t < TXG_SIZE; t++) {
+ (void) txg_list_remove_this(
+ &tvd->vdev_dtl_list, vml[c], t);
+ }
+
vdev_split(vml[c]);
if (error == 0)
spa_history_log_internal(spa, "detach", tx,