diff options
| author | Dan Carpenter <dan.carpenter@oracle.com> | 2018-08-20 11:25:33 +0300 |
|---|---|---|
| committer | David Sterba <dsterba@suse.com> | 2018-08-23 17:37:27 +0200 |
| commit | b9b8a41adeff5666b402996020b698504c927353 (patch) | |
| tree | aeceb9763a86ff57b52915a88c7fbcf767a700dd /fs/ocfs2/dir.c | |
| parent | 801660b040d132f67fac6a95910ad307c5929b49 (diff) | |
| download | linux-b9b8a41adeff5666b402996020b698504c927353.tar.gz linux-b9b8a41adeff5666b402996020b698504c927353.tar.bz2 linux-b9b8a41adeff5666b402996020b698504c927353.zip | |
btrfs: use after free in btrfs_quota_enable
The issue here is that btrfs_commit_transaction() frees "trans" on both
the error and the success path. So the problem would be if
btrfs_commit_transaction() succeeds, and then qgroup_rescan_init()
fails. That means that "ret" is non-zero and "trans" is non-NULL and it
leads to a use after free inside the btrfs_end_transaction() macro.
Fixes: 340f1aa27f36 ("btrfs: qgroups: Move transaction management inside btrfs_quota_enable/disable")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: Nikolay Borisov <nborisov@suse.com>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Diffstat (limited to 'fs/ocfs2/dir.c')
0 files changed, 0 insertions, 0 deletions