# HG changeset patch
# User Will Andrews <will@firepipe.net>
# Date 1370970818 28800
# Node ID e8c1f215cb159a84de45f4fb1af05f95273aae5e
# Parent  6a5a2f4a47db2c5f9aac087007b231dd70465144
3743 zfs needs a refcount audit
Reviewed by: Matthew Ahrens <mahrens@delphix.com>
Reviewed by: Eric Schrock <eric.schrock@delphix.com>
Reviewed by: George Wilson <george.wilson@delphix.com>
Approved by: Christopher Siden <christopher.siden@delphix.com>

diff -r 6a5a2f4a47db -r e8c1f215cb15 usr/src/uts/common/fs/zfs/dsl_dataset.c
--- a/usr/src/uts/common/fs/zfs/dsl_dataset.c	Tue Jun 11 09:13:33 2013 -0800
+++ b/usr/src/uts/common/fs/zfs/dsl_dataset.c	Tue Jun 11 09:13:38 2013 -0800
@@ -356,8 +356,10 @@
 
 	/* Make sure dsobj has the correct object type. */
 	dmu_object_info_from_db(dbuf, &doi);
-	if (doi.doi_type != DMU_OT_DSL_DATASET)
+	if (doi.doi_type != DMU_OT_DSL_DATASET) {
+		dmu_buf_rele(dbuf, tag);
 		return (SET_ERROR(EINVAL));
+	}
 
 	ds = dmu_buf_get_user(dbuf);
 	if (ds == NULL) {
diff -r 6a5a2f4a47db -r e8c1f215cb15 usr/src/uts/common/fs/zfs/spa_errlog.c
--- a/usr/src/uts/common/fs/zfs/spa_errlog.c	Tue Jun 11 09:13:33 2013 -0800
+++ b/usr/src/uts/common/fs/zfs/spa_errlog.c	Tue Jun 11 09:13:38 2013 -0800
@@ -183,8 +183,10 @@
 
 		if (copyout(&zb, (char *)addr +
 		    (*count - 1) * sizeof (zbookmark_t),
-		    sizeof (zbookmark_t)) != 0)
+		    sizeof (zbookmark_t)) != 0) {
+			zap_cursor_fini(&zc);
 			return (SET_ERROR(EFAULT));
+		}
 
 		*count -= 1;
 	}
diff -r 6a5a2f4a47db -r e8c1f215cb15 usr/src/uts/common/fs/zfs/zap.c
--- a/usr/src/uts/common/fs/zfs/zap.c	Tue Jun 11 09:13:33 2013 -0800
+++ b/usr/src/uts/common/fs/zfs/zap.c	Tue Jun 11 09:13:38 2013 -0800
@@ -295,7 +295,8 @@
 		err = dmu_buf_hold(zap->zap_objset, zap->zap_object,
 		    (tbl->zt_nextblk + blk) << bs, FTAG, &db,
 		    DMU_READ_NO_PREFETCH);
-		dmu_buf_rele(db, FTAG);
+		if (err == 0)
+			dmu_buf_rele(db, FTAG);
 	}
 	return (err);
 }
@@ -992,18 +993,21 @@
 	zap_attribute_t za;
 	int err;
 
+	err = 0;
 	for (zap_cursor_init(&zc, os, fromobj);
 	    zap_cursor_retrieve(&zc, &za) == 0;
 	    (void) zap_cursor_advance(&zc)) {
-		if (za.za_integer_length != 8 || za.za_num_integers != 1)
-			return (SET_ERROR(EINVAL));
+		if (za.za_integer_length != 8 || za.za_num_integers != 1) {
+			err = SET_ERROR(EINVAL);
+			break;
+		}
 		err = zap_add(os, intoobj, za.za_name,
 		    8, 1, &za.za_first_integer, tx);
 		if (err)
-			return (err);
+			break;
 	}
 	zap_cursor_fini(&zc);
-	return (0);
+	return (err);
 }
 
 int
@@ -1014,18 +1018,21 @@
 	zap_attribute_t za;
 	int err;
 
+	err = 0;
 	for (zap_cursor_init(&zc, os, fromobj);
 	    zap_cursor_retrieve(&zc, &za) == 0;
 	    (void) zap_cursor_advance(&zc)) {
-		if (za.za_integer_length != 8 || za.za_num_integers != 1)
-			return (SET_ERROR(EINVAL));
+		if (za.za_integer_length != 8 || za.za_num_integers != 1) {
+			err = SET_ERROR(EINVAL);
+			break;
+		}
 		err = zap_add(os, intoobj, za.za_name,
 		    8, 1, &value, tx);
 		if (err)
-			return (err);
+			break;
 	}
 	zap_cursor_fini(&zc);
-	return (0);
+	return (err);
 }
 
 int
@@ -1036,24 +1043,27 @@
 	zap_attribute_t za;
 	int err;
 
+	err = 0;
 	for (zap_cursor_init(&zc, os, fromobj);
 	    zap_cursor_retrieve(&zc, &za) == 0;
 	    (void) zap_cursor_advance(&zc)) {
 		uint64_t delta = 0;
 
-		if (za.za_integer_length != 8 || za.za_num_integers != 1)
-			return (SET_ERROR(EINVAL));
+		if (za.za_integer_length != 8 || za.za_num_integers != 1) {
+			err = SET_ERROR(EINVAL);
+			break;
+		}
 
 		err = zap_lookup(os, intoobj, za.za_name, 8, 1, &delta);
 		if (err != 0 && err != ENOENT)
-			return (err);
+			break;
 		delta += za.za_first_integer;
 		err = zap_update(os, intoobj, za.za_name, 8, 1, &delta, tx);
 		if (err)
-			return (err);
+			break;
 	}
 	zap_cursor_fini(&zc);
-	return (0);
+	return (err);
 }
 
 int