Illumos #3743

3743 zfs needs a refcount audit
Reviewed by: Matthew Ahrens <mahrens@delphix.com>
Reviewed by: Eric Schrock <eric.schrock@delphix.com>
Reviewed by: George Wilson <george.wilson@delphix.com>
Approved by: Christopher Siden <christopher.siden@delphix.com>

References:
  https://www.illumos.org/issues/3743
  illumos/illumos-gate@b287be1ba86043996f49b1cc34c80cc620f9b841

Ported-by: Richard Yao <ryao@gentoo.org>
Signed-off-by: Brian Behlendorf <behlendorf1@llnl.gov>
Issue #1775

diff --git a/module/zfs/dsl_dataset.c b/module/zfs/dsl_dataset.c
index 4639a43df143923d01f485d0e1f526ccc0655978..5ed3e8e8722c54f5258a88c05a13b783f1d0cc54 100644 (file)
--- a/module/zfs/dsl_dataset.c
+++ b/module/zfs/dsl_dataset.c
@@ -360,8 +360,10 @@ dsl_dataset_hold_obj(dsl_pool_t *dp, uint64_t dsobj, void *tag,
 
        /* Make sure dsobj has the correct object type. */
        dmu_object_info_from_db(dbuf, &doi);
-       if (doi.doi_type != DMU_OT_DSL_DATASET)
+       if (doi.doi_type != DMU_OT_DSL_DATASET) {
+               dmu_buf_rele(dbuf, tag);
                return (SET_ERROR(EINVAL));
+       }
 
        ds = dmu_buf_get_user(dbuf);
        if (ds == NULL) {

diff --git a/module/zfs/spa_errlog.c b/module/zfs/spa_errlog.c
index 21abc833908619e433bf30e34bb7399fdbe2d5a8..35853e2825503a6a8930641053893bb4ab151a13 100644 (file)
--- a/module/zfs/spa_errlog.c
+++ b/module/zfs/spa_errlog.c
@@ -183,8 +183,10 @@ process_error_log(spa_t *spa, uint64_t obj, void *addr, size_t *count)
 
                if (copyout(&zb, (char *)addr +
                    (*count - 1) * sizeof (zbookmark_t),
-                   sizeof (zbookmark_t)) != 0)
+                   sizeof (zbookmark_t)) != 0) {
+                       zap_cursor_fini(&zc);
                        return (SET_ERROR(EFAULT));
+               }
 
                *count -= 1;
        }

diff --git a/module/zfs/zap.c b/module/zfs/zap.c
index 66c303eb42c5fe453e0661e7343fce200cfa13ec..cfae26a749995393b182641a4e77516faef97db2 100644 (file)
--- a/module/zfs/zap.c
+++ b/module/zfs/zap.c
@@ -295,7 +295,8 @@ zap_table_load(zap_t *zap, zap_table_phys_t *tbl, uint64_t idx, uint64_t *valp)
                err = dmu_buf_hold(zap->zap_objset, zap->zap_object,
                    (tbl->zt_nextblk + blk) << bs, FTAG, &db,
                    DMU_READ_NO_PREFETCH);
-               dmu_buf_rele(db, FTAG);
+               if (err == 0)
+                       dmu_buf_rele(db, FTAG);
        }
        return (err);
 }
@@ -992,18 +993,21 @@ zap_join(objset_t *os, uint64_t fromobj, uint64_t intoobj, dmu_tx_t *tx)
        zap_attribute_t za;
        int err;
 
+       err = 0;
        for (zap_cursor_init(&zc, os, fromobj);
            zap_cursor_retrieve(&zc, &za) == 0;
            (void) zap_cursor_advance(&zc)) {
-               if (za.za_integer_length != 8 || za.za_num_integers != 1)
-                       return (SET_ERROR(EINVAL));
+               if (za.za_integer_length != 8 || za.za_num_integers != 1) {
+                       err = SET_ERROR(EINVAL);
+                       break;
+               }
                err = zap_add(os, intoobj, za.za_name,
                    8, 1, &za.za_first_integer, tx);
                if (err)
-                       return (err);
+                       break;
        }
        zap_cursor_fini(&zc);
-       return (0);
+       return (err);
 }
 
 int
@@ -1014,18 +1018,21 @@ zap_join_key(objset_t *os, uint64_t fromobj, uint64_t intoobj,
        zap_attribute_t za;
        int err;
 
+       err = 0;
        for (zap_cursor_init(&zc, os, fromobj);
            zap_cursor_retrieve(&zc, &za) == 0;
            (void) zap_cursor_advance(&zc)) {
-               if (za.za_integer_length != 8 || za.za_num_integers != 1)
-                       return (SET_ERROR(EINVAL));
+               if (za.za_integer_length != 8 || za.za_num_integers != 1) {
+                       err = SET_ERROR(EINVAL);
+                       break;
+               }
                err = zap_add(os, intoobj, za.za_name,
                    8, 1, &value, tx);
                if (err)
-                       return (err);
+                       break;
        }
        zap_cursor_fini(&zc);
-       return (0);
+       return (err);
 }
 
 int
@@ -1036,24 +1043,27 @@ zap_join_increment(objset_t *os, uint64_t fromobj, uint64_t intoobj,
        zap_attribute_t za;
        int err;
 
+       err = 0;
        for (zap_cursor_init(&zc, os, fromobj);
            zap_cursor_retrieve(&zc, &za) == 0;
            (void) zap_cursor_advance(&zc)) {
                uint64_t delta = 0;
 
-               if (za.za_integer_length != 8 || za.za_num_integers != 1)
-                       return (SET_ERROR(EINVAL));
+               if (za.za_integer_length != 8 || za.za_num_integers != 1) {
+                       err = SET_ERROR(EINVAL);
+                       break;
+               }
 
                err = zap_lookup(os, intoobj, za.za_name, 8, 1, &delta);
                if (err != 0 && err != ENOENT)
-                       return (err);
+                       break;
                delta += za.za_first_integer;
                err = zap_update(os, intoobj, za.za_name, 8, 1, &delta, tx);
                if (err)
-                       return (err);
+                       break;
        }
        zap_cursor_fini(&zc);
-       return (0);
+       return (err);
 }
 
 int