Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 2037a093 authored by Sasha Levin's avatar Sasha Levin Committed by Chris Mason
Browse files

btrfs: use after free when closing devices 



__btrfs_close_devices() would call_rcu to free the device, which is racy with
list_for_each_entry() accessing the memory to retrieve the next device on the
list.

Signed-off-by: default avatarSasha Levin <sasha.levin@oracle.com>
Reviewed-by: default avatarDavid Sterba <dsterba@suse.cz>
Signed-off-by: default avatarChris Mason <clm@fb.com>
parent 01b810b8

fs/btrfs/volumes.c

+2 −2
Original line number Diff line number Diff line
@@ -693,13 +693,13 @@ static void free_device(struct rcu_head *head) 


static int __btrfs_close_devices(struct btrfs_fs_devices *fs_devices)

{

	struct btrfs_device *device;

	struct btrfs_device *device, *tmp;



	if (--fs_devices->opened > 0)

		return 0;



	mutex_lock(&fs_devices->device_list_mutex);

	list_for_each_entry(device, &fs_devices->devices, dev_list) {

	list_for_each_entry_safe(device, tmp, &fs_devices->devices, dev_list) {

		struct btrfs_device *new_device;

		struct rcu_string *name;