Skip to content

Fix double free when cloning a block with a pending free #18853

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
patrickdk77 wants to merge 2 commits into
base: master
Choose a base branch
from
+38 −0
Open

Fix double free when cloning a block with a pending free #18853

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
86f58c7
Fix double free when cloning a block with a pending free
patrickdk77 Jul 26, 2026
5de01f5
Cover holes and overridden BPs in the clone pending-free check
patrickdk77 Jul 28, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
38 changes: 38 additions & 0 deletions module/zfs/dmu.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2838,6 +2838,44 @@ dmu_read_l0_bps(objset_t *os, uint64_t object, uint64_t offset, uint64_t length,
bp = db->db_blkptr;
}

/*
* A block with a pending free (a truncate or hole
* punch not yet synced) must not be cloned: the clone
* would add a BRT reference to a block about to be
* freed, so the pending clone would apply onto an
* already-freed DVA and double free it. Report
* EAGAIN and let the caller retry once the free
* syncs (the block then reads as a hole).
*
* A hole (or absent BP) has nothing to free and is
* cloned as a hole below. When the head dirty record
* overrode the BP (a clone in this txg) only frees
* recorded after the override count against it;
* earlier frees predate it. This mirrors
* dbuf_read_hole().
*/
if (bp != NULL && !BP_IS_HOLE(bp)) {
dbuf_dirty_record_t *dr =
list_head(&db->db_dirty_records);
boolean_t freed;

DB_DNODE_ENTER(db);
dnode_t *rdn = DB_DNODE(db);
if (dr != NULL && dr->dt.dl.dr_brtwrite) {
freed = dnode_block_freed_after(rdn,
db->db_blkid, dr->dr_txg);
} else {
freed = dnode_block_freed(rdn,
db->db_blkid);
}
DB_DNODE_EXIT(db);
if (freed) {
mutex_exit(&db->db_mtx);
error = SET_ERROR(EAGAIN);
goto out;
}
}

mutex_exit(&db->db_mtx);

if (bp == NULL) {
Expand Down
Loading