From 03064813c5798db171278643009758dec34d9c58 Mon Sep 17 00:00:00 2001 From: Richard Yao Date: Fri, 31 Jul 2026 20:38:21 -0400 Subject: [PATCH] Fix NULL pointer dereference in dsl_deadlist_close() after error c33a55b0c201dce9457bc6632f68fc87a903a6af allowed dsl_deadlist_open() to return errors. However, when dsl_deadlist_open() returns an error, dsl_deadlist_close() is called. If the error is from dmu_bonus_hold(), dsl_deadlist_close() will call dmu_buf_rele() on a NULL pointer. Closes #17809 Reported-by: Grok 4.5 Build Beta Signed-off-by: Richard Yao --- module/zfs/dsl_deadlist.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/module/zfs/dsl_deadlist.c b/module/zfs/dsl_deadlist.c index 8b7b7cef1806..dcb324b48ac8 100644 --- a/module/zfs/dsl_deadlist.c +++ b/module/zfs/dsl_deadlist.c @@ -368,8 +368,14 @@ dsl_deadlist_close(dsl_deadlist_t *dl) } avl_destroy(&dl->dl_cache); } - dmu_buf_rele(dl->dl_dbuf, dl); - dl->dl_dbuf = NULL; + /* + * If dmu_bonus_hold() fails in dsl_deadlist_open(), we are left with + * an "open" deadlist that has no hold to release. + */ + if (dl->dl_dbuf != NULL) { + dmu_buf_rele(dl->dl_dbuf, dl); + dl->dl_dbuf = NULL; + } dl->dl_phys = NULL; dl->dl_os = NULL; dl->dl_object = 0;