svn commit: r355736 - head/stand/libsa/zfs

[Andriy Gapon]

Author: avg
Date: Fri Dec 13 22:04:13 2019
New Revision: 355736
URL: https://svnweb.freebsd.org/changeset/base/355736

Log:
  zfs boot: fix a crash in a rarely taken path in fzap_lookup
  
  Instead of passing NULL to fzap_name_equal and crashing, just return
  ENOENT.  This happened when higher bits of a hash of the searched key
  (its hash prefix) matched a hash prefix of some key in the ZAP, but the
  full hash value of the searched key did not match any key in the ZAP.
  
  I observerved this problem when loader tried to look up
  "features_for_read" in a particular old pool that predates pool
  features.
  
  MFC after:	2 weeks
  Sponsored by:	Panzura

Modified:
  head/stand/libsa/zfs/zfsimpl.c

Modified: head/stand/libsa/zfs/zfsimpl.c
==============================================================================
--- head/stand/libsa/zfs/zfsimpl.c	Fri Dec 13 21:39:20 2019	(r355735)
+++ head/stand/libsa/zfs/zfsimpl.c	Fri Dec 13 22:04:13 2019	(r355736)
@@ -2282,10 +2282,8 @@ fzap_lookup(const spa_t *spa, const dnode_phys_t *dnod
 		return (ENOENT);
 	zc = &ZAP_LEAF_CHUNK(&zl, h);
 	while (zc->l_entry.le_hash != hash) {
-		if (zc->l_entry.le_next == 0xffff) {
-			zc = NULL;
-			break;
-		}
+		if (zc->l_entry.le_next == 0xffff)
+			return (ENOENT);
 		zc = &ZAP_LEAF_CHUNK(&zl, zc->l_entry.le_next);
 	}
 	if (fzap_name_equal(&zl, zc, name)) {