luck/tmp_suning_uos_patched
1
0
Fork 1
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Btrfs: fix use-after-free in __btrfs_end_transaction

Browse Source 
49b25e0540 introduced a use-after-free bug
that caused spurious -EIO's to be returned.

Do the check before we free the transaction.

Cc: David Sterba <dsterba@suse.cz>
Cc: Jeff Mahoney <jeffm@suse.com>
Signed-off-by: Dave Jones <davej@redhat.com>
Signed-off-by: Chris Mason <chris.mason@oracle.com>
This commit is contained in:
Dave Jones 2012-04-12 16:03:56 -04:00 committed by Chris Mason
parent e627ee7bcd
commit 4edc2ca388
1 changed files with 5 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
fs/btrfs/transaction.c
View File

@ -480,6 +480,7 @@ static int __btrfs_end_transaction(struct btrfs_trans_handle *trans,
struct btrfs_transaction *cur_trans = trans->transaction; struct btrfs_transaction *cur_trans = trans->transaction;
struct btrfs_fs_info *info = root->fs_info; struct btrfs_fs_info *info = root->fs_info;
int count = 0; int count = 0;
int err = 0;
if (--trans->use_count) { if (--trans->use_count) {
trans->block_rsv = trans->orig_rsv; trans->block_rsv = trans->orig_rsv;
@ -532,18 +533,18 @@ static int __btrfs_end_transaction(struct btrfs_trans_handle *trans,
if (current->journal_info == trans) if (current->journal_info == trans)
current->journal_info = NULL; current->journal_info = NULL;
memset(trans, 0, sizeof(*trans));
kmem_cache_free(btrfs_trans_handle_cachep, trans);
if (throttle) if (throttle)
btrfs_run_delayed_iputs(root); btrfs_run_delayed_iputs(root);
if (trans->aborted || if (trans->aborted ||
root->fs_info->fs_state & BTRFS_SUPER_FLAG_ERROR) { root->fs_info->fs_state & BTRFS_SUPER_FLAG_ERROR) {
return -EIO; err = -EIO;
} }
return 0; memset(trans, 0, sizeof(*trans));
kmem_cache_free(btrfs_trans_handle_cachep, trans);
return err;
} }
int btrfs_end_transaction(struct btrfs_trans_handle *trans, int btrfs_end_transaction(struct btrfs_trans_handle *trans,