Fix removal of SA in sa_modify_attrs()

The sa_modify_attrs() function can add, remove or replace an SA.
The main loop in the function uses the index "i" to iterate over the
existing SAs and uses the index "j" for writing them into a new buffer
via SA_ADD_BULK_ATTR().  The write index, "j" is incremented on remove
(SA_REMOVE) operations which leads to a corruption in the new SA buffer.
This patch remove the increment for SA_REMOVE operations.

Signed-off-by: Brian Behlendorf <behlendorf1@llnl.gov>
Signed-off-by: Tim Chase <tim@chase2k.com>
Signed-off-by: Ned Bass <bass6@llnl.gov>
Closes #3028

diff --git a/module/zfs/sa.c b/module/zfs/sa.c
index 1263d37ab0096608474bd9b1f48d809cdb5758cf..25b4da9f8a7d0385b96b9f7e885074a1df2cad90 100644 (file)
--- a/module/zfs/sa.c
+++ b/module/zfs/sa.c
@@ -1730,10 +1730,8 @@ sa_modify_attrs(sa_handle_t *hdl, sa_attr_type_t newattr,
                        if (attr == newattr) {
                                if (length == 0)
                                        ++length_idx;
-                               if (action == SA_REMOVE) {
-                                       j++;
+                               if (action == SA_REMOVE)
                                        continue;
-                               }
                                ASSERT(length == 0);
                                ASSERT(action == SA_REPLACE);
                                SA_ADD_BULK_ATTR(attr_desc, j, attr,