diff options
| author | Dave Jones <davej@redhat.com> | 2012-04-12 16:03:56 -0400 |
|---|---|---|
| committer | Chris Mason <chris.mason@oracle.com> | 2012-04-12 16:03:56 -0400 |
| commit | 4edc2ca388d62abffe38149f6ac00e749ea721c5 (patch) | |
| tree | 6e31a2d72b9bb05f46960c0a8a789044f5dcf584 /fs/btrfs | |
| parent | e627ee7bcd42b4e3a03ca01a8e46dcb4033c5ae0 (diff) | |
| download | linux-4edc2ca388d62abffe38149f6ac00e749ea721c5.tar.gz linux-4edc2ca388d62abffe38149f6ac00e749ea721c5.tar.bz2 linux-4edc2ca388d62abffe38149f6ac00e749ea721c5.zip | |
Btrfs: fix use-after-free in __btrfs_end_transaction
49b25e0540904be0bf558b84475c69d72e4de66e introduced a use-after-free bug
that caused spurious -EIO's to be returned.
Do the check before we free the transaction.
Cc: David Sterba <dsterba@suse.cz>
Cc: Jeff Mahoney <jeffm@suse.com>
Signed-off-by: Dave Jones <davej@redhat.com>
Signed-off-by: Chris Mason <chris.mason@oracle.com>
Diffstat (limited to 'fs/btrfs')
| -rw-r--r-- | fs/btrfs/transaction.c | 9 |
1 files changed, 5 insertions, 4 deletions
diff --git a/fs/btrfs/transaction.c b/fs/btrfs/transaction.c index 8da29e8e4de1..11b77a59db62 100644 --- a/fs/btrfs/transaction.c +++ b/fs/btrfs/transaction.c @@ -480,6 +480,7 @@ static int __btrfs_end_transaction(struct btrfs_trans_handle *trans, struct btrfs_transaction *cur_trans = trans->transaction; struct btrfs_fs_info *info = root->fs_info; int count = 0; + int err = 0; if (--trans->use_count) { trans->block_rsv = trans->orig_rsv; @@ -532,18 +533,18 @@ static int __btrfs_end_transaction(struct btrfs_trans_handle *trans, if (current->journal_info == trans) current->journal_info = NULL; - memset(trans, 0, sizeof(*trans)); - kmem_cache_free(btrfs_trans_handle_cachep, trans); if (throttle) btrfs_run_delayed_iputs(root); if (trans->aborted || root->fs_info->fs_state & BTRFS_SUPER_FLAG_ERROR) { - return -EIO; + err = -EIO; } - return 0; + memset(trans, 0, sizeof(*trans)); + kmem_cache_free(btrfs_trans_handle_cachep, trans); + return err; } int btrfs_end_transaction(struct btrfs_trans_handle *trans, |