Fix misuse of input argument in traverse_visitbp

In traverse_visitbp(), the input argument dnp is modified in the middle to
point to a temporary buffer. Originally this doesn't matter, because no user
of TRAVERSE_POST dereferences it. However, in fbeddd6 a piece of code is added
dereferencing dnp after the modification, creating a possible bug.

We fix this by creating a new local variable cdnp for the DMU_OT_DNODE case,
so we don't modify the input argument. Also we introduce different local
variables in the DMU_OT_OBJSET case to prevent confusion between the input
argument.

Signed-off-by: Chunwei Chen <tuxoko@gmail.com>
Signed-off-by: Richard Yao <ryao@gentoo.org>
Signed-off-by: Tim Chase <tim@chase2k.com>
Signed-off-by: Brian Behlendorf <behlendorf1@llnl.gov>
Closes #2060

diff --git a/module/zfs/dmu_traverse.c b/module/zfs/dmu_traverse.c
index 9280a89b2f850675acdb997a9ef556ee2ec9b4b9..3f98c8feb974170cc85bedbda24a6c0cebcc0f33 100644 (file)
--- a/module/zfs/dmu_traverse.c
+++ b/module/zfs/dmu_traverse.c
@@ -314,21 +314,22 @@ traverse_visitbp(traverse_data_t *td, const dnode_phys_t *dnp,
                uint32_t flags = ARC_WAIT;
                int32_t i;
                int32_t epb = BP_GET_LSIZE(bp) >> DNODE_SHIFT;
+               dnode_phys_t *cdnp;
 
                err = arc_read(NULL, td->td_spa, bp, arc_getbuf_func, &buf,
                    ZIO_PRIORITY_ASYNC_READ, ZIO_FLAG_CANFAIL, &flags, zb);
                if (err != 0)
                        goto post;
-               dnp = buf->b_data;
+               cdnp = buf->b_data;
 
                for (i = 0; i < epb; i++) {
-                       prefetch_dnode_metadata(td, &dnp[i], zb->zb_objset,
+                       prefetch_dnode_metadata(td, &cdnp[i], zb->zb_objset,
                            zb->zb_blkid * epb + i);
                }
 
                /* recursively visitbp() blocks below this */
                for (i = 0; i < epb; i++) {
-                       err = traverse_dnode(td, &dnp[i], zb->zb_objset,
+                       err = traverse_dnode(td, &cdnp[i], zb->zb_objset,
                            zb->zb_blkid * epb + i);
                        if (err != 0)
                                break;
@@ -336,7 +337,7 @@ traverse_visitbp(traverse_data_t *td, const dnode_phys_t *dnp,
        } else if (BP_GET_TYPE(bp) == DMU_OT_OBJSET) {
                uint32_t flags = ARC_WAIT;
                objset_phys_t *osp;
-               dnode_phys_t *dnp;
+               dnode_phys_t *mdnp, *gdnp, *udnp;
 
                err = arc_read(NULL, td->td_spa, bp, arc_getbuf_func, &buf,
                    ZIO_PRIORITY_ASYNC_READ, ZIO_FLAG_CANFAIL, &flags, zb);
@@ -344,26 +345,27 @@ traverse_visitbp(traverse_data_t *td, const dnode_phys_t *dnp,
                        goto post;
 
                osp = buf->b_data;
-               dnp = &osp->os_meta_dnode;
-               prefetch_dnode_metadata(td, dnp, zb->zb_objset,
+               mdnp = &osp->os_meta_dnode;
+               gdnp = &osp->os_groupused_dnode;
+               udnp = &osp->os_userused_dnode;
+
+               prefetch_dnode_metadata(td, mdnp, zb->zb_objset,
                    DMU_META_DNODE_OBJECT);
                if (arc_buf_size(buf) >= sizeof (objset_phys_t)) {
-                       prefetch_dnode_metadata(td, &osp->os_groupused_dnode,
-                           zb->zb_objset, DMU_GROUPUSED_OBJECT);
-                       prefetch_dnode_metadata(td, &osp->os_userused_dnode,
-                           zb->zb_objset, DMU_USERUSED_OBJECT);
+                       prefetch_dnode_metadata(td, gdnp, zb->zb_objset,
+                           DMU_GROUPUSED_OBJECT);
+                       prefetch_dnode_metadata(td, udnp, zb->zb_objset,
+                           DMU_USERUSED_OBJECT);
                }
 
-               err = traverse_dnode(td, dnp, zb->zb_objset,
+               err = traverse_dnode(td, mdnp, zb->zb_objset,
                    DMU_META_DNODE_OBJECT);
                if (err == 0 && arc_buf_size(buf) >= sizeof (objset_phys_t)) {
-                       dnp = &osp->os_groupused_dnode;
-                       err = traverse_dnode(td, dnp, zb->zb_objset,
+                       err = traverse_dnode(td, gdnp, zb->zb_objset,
                            DMU_GROUPUSED_OBJECT);
                }
                if (err == 0 && arc_buf_size(buf) >= sizeof (objset_phys_t)) {
-                       dnp = &osp->os_userused_dnode;
-                       err = traverse_dnode(td, dnp, zb->zb_objset,
+                       err = traverse_dnode(td, udnp, zb->zb_objset,
                            DMU_USERUSED_OBJECT);
                }
        }