Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit bf023ecf authored by Ilya Dryomov's avatar Ilya Dryomov Committed by Josef Bacik
Browse files

Btrfs: eliminate a use-after-free in btrfs_balance() 



Commit 5af3e8cc introduced a use-after-free at volumes.c:3139: bctl is freed
above in __cancel_balance() in all cases except for balance pause.  Fix this
by moving the offending check a couple statements above, the meaning of the
check is preserved.

Reported-by: default avatarChris Mason <chris.mason@fusionio.com>
Signed-off-by: default avatarIlya Dryomov <idryomov@gmail.com>
Signed-off-by: default avatarJosef Bacik <jbacik@fusionio.com>
parent c8f2f24b

fs/btrfs/volumes.c

+5 −5
Original line number Original line Diff line number Diff line
@@ -3195,6 +3195,11 @@ int btrfs_balance(struct btrfs_balance_control *bctl, 
	mutex_lock(&fs_info->balance_mutex);

	mutex_lock(&fs_info->balance_mutex);

	atomic_dec(&fs_info->balance_running);

	atomic_dec(&fs_info->balance_running);





	if (bctl->sys.flags & BTRFS_BALANCE_ARGS_CONVERT) {

		fs_info->num_tolerated_disk_barrier_failures =

			btrfs_calc_num_tolerated_disk_barrier_failures(fs_info);

	}



	if (bargs) {

	if (bargs) {

		memset(bargs, 0, sizeof(*bargs));

		memset(bargs, 0, sizeof(*bargs));

		update_ioctl_balance_args(fs_info, 0, bargs);

		update_ioctl_balance_args(fs_info, 0, bargs);
@@ -3205,11 +3210,6 @@ int btrfs_balance(struct btrfs_balance_control *bctl, 
		__cancel_balance(fs_info);

		__cancel_balance(fs_info);

	}

	}





	if (bctl->sys.flags & BTRFS_BALANCE_ARGS_CONVERT) {

		fs_info->num_tolerated_disk_barrier_failures =

			btrfs_calc_num_tolerated_disk_barrier_failures(fs_info);

	}



	wake_up(&fs_info->balance_wait_q);

	wake_up(&fs_info->balance_wait_q);





	return ret;

	return ret;