DragonFlyBSD Kernel Audit
DF-2651 / fix.diff
← back to finding ↓ download raw
--- a/sys/vfs/hammer2/hammer2_freemap.c
+++ b/sys/vfs/hammer2/hammer2_freemap.c
@@ -1013,12 +1013,18 @@
 	/*
 	 * Stop early if we are trying to free something but no leaf exists.
 	 */
-	if (chain == NULL && how != HAMMER2_FREEMAP_DORECOVER) {
-		kprintf("hammer2_freemap_adjust: %016jx: no chain\n",
-			(intmax_t)bref->data_off);
-		goto done;
-	}
-	if (chain->error) {
+	/*
+	 * DF-2651: chain can legitimately be NULL here (missing freemap
+	 * leaf); only DORECOVER creates it further down.  Do not touch
+	 * chain->error until NULL has been ruled out.
+	 */
+	if (chain == NULL) {
+		if (how != HAMMER2_FREEMAP_DORECOVER) {
+			kprintf("hammer2_freemap_adjust: %016jx: no chain\n",
+				(intmax_t)bref->data_off);
+			goto done;
+		}
+	} else if (chain->error) {
 		kprintf("hammer2_freemap_adjust: %016jx: error %s\n",
 			(intmax_t)bref->data_off,
 			hammer2_error_str(chain->error));