svn commit: r316930 - vendor-sys/illumos/dist/uts/common/fs/zfs

[Andriy Gapon]

Author: avg
Date: Fri Apr 14 18:43:10 2017
New Revision: 316930
URL: https://svnweb.freebsd.org/changeset/base/316930

Log:
  5814 bpobj_iterate_impl(): Close a refcount leak iterating on a sublist.
  
  illumos/illumos-gate at b67dde11a73a9455d641403cbbb65ec2add41b41
  https://github.com/illumos/illumos-gate/commit/b67dde11a73a9455d641403cbbb65ec2add41b41
  
  https://www.illumos.org/issues/5814
    Lets pull in this patch from freebsd:
    http://svnweb.freebsd.org/base?view=revision&revision=271781
    bpobj_iterate_impl(): Close a refcount leak iterating on a sublist.
    If bpobj_space() returned non-zero here, the sublist would have been
    left open, along with the bonus buffer hold it requires. This call
    does not invoke any calls to bpobj_close() itself.
    This bug doesn't have any known vector, but was found on inspection.
    MFC after: 1 week
    Sponsored by: Spectra Logic
    Affects: All ZFS versions starting 21 May 2010 (illumos cde58dbc)
    MFSpectraBSD: r1050998 on 2014/03/26
    Fix bpobj_iterate_impl() to properly call bpobj_close() if bpobj_space()
    returns an error.
  
  Reviewed by: Prakash Surya <prakash.surya at delphix.com>
  Reviewed by: Matthew Ahrens <mahrens at delphix.com>
  Reviewed by: Paul Dagnelie <paul.dagnelie at delphix.com>
  Reviewed by: Simon Klinkert <simon.klinkert at gmail.com>
  Approved by: Gordon Ross <gwr at nexenta.com>
  Author: Will Andrews <will at freebsd.org>

Modified:
  vendor-sys/illumos/dist/uts/common/fs/zfs/bpobj.c

Modified: vendor-sys/illumos/dist/uts/common/fs/zfs/bpobj.c
==============================================================================
--- vendor-sys/illumos/dist/uts/common/fs/zfs/bpobj.c	Fri Apr 14 18:41:37 2017	(r316929)
+++ vendor-sys/illumos/dist/uts/common/fs/zfs/bpobj.c	Fri Apr 14 18:43:10 2017	(r316930)
@@ -301,8 +301,10 @@ bpobj_iterate_impl(bpobj_t *bpo, bpobj_i
 		if (free) {
 			err = bpobj_space(&sublist,
 			    &used_before, &comp_before, &uncomp_before);
-			if (err)
+			if (err != 0) {
+				bpobj_close(&sublist);
 				break;
+			}
 		}
 		err = bpobj_iterate_impl(&sublist, func, arg, tx, free);
 		if (free) {