K 10
svn:author
V 3
mav
K 8
svn:date
V 27
2019-11-28T18:28:35.719881Z
K 7
svn:log
V 582
Fix use-after-free in case of L2ARC prefetch failure.

In case L2ARC read failed, l2arc_read_done() creates _different_ ZIO
to read data from the original storage device.  Unfortunately pointer
to the failed ZIO remains in hdr->b_l1hdr.b_acb->acb_zio_head, and if
some other read try to bump the ZIO priority, it will crash.

The problem is reproducible by corrupting L2ARC content and reading
some data with prefetch if l2arc_noprefetch tunable is changed to 0.
With the default setting the issue is probably not reproducible now.

MFC after:	2 weeks
Sponsored by:	iXsystems, Inc.

END