Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 22883ddc authored by Lu Fengqi's avatar Lu Fengqi Committed by David Sterba
Browse files

btrfs: fix invalid-free in btrfs_extent_same 



If this condition ((BTRFS_I(src)->flags & BTRFS_INODE_NODATASUM) !=
		   (BTRFS_I(dst)->flags & BTRFS_INODE_NODATASUM))
is hit, we will go to free the uninitialized cmp.src_pages and
cmp.dst_pages.

Fixes: 67b07bd4 ("Btrfs: reuse cmp workspace in EXTENT_SAME ioctl")
Signed-off-by: default avatarLu Fengqi <lufq.fnst@cn.fujitsu.com>
Reviewed-by: default avatarDavid Sterba <dsterba@suse.com>
Signed-off-by: default avatarDavid Sterba <dsterba@suse.com>
parent f0986318

fs/btrfs/ioctl.c

+5 −5
Original line number Diff line number Diff line
@@ -3577,7 +3577,7 @@ static int btrfs_extent_same(struct inode *src, u64 loff, u64 olen, 
		ret = btrfs_extent_same_range(src, loff, BTRFS_MAX_DEDUPE_LEN,

					      dst, dst_loff, &cmp);

		if (ret)

			goto out_unlock;

			goto out_free;



		loff += BTRFS_MAX_DEDUPE_LEN;

		dst_loff += BTRFS_MAX_DEDUPE_LEN;
@@ -3587,16 +3587,16 @@ static int btrfs_extent_same(struct inode *src, u64 loff, u64 olen, 
		ret = btrfs_extent_same_range(src, loff, tail_len, dst,

					      dst_loff, &cmp);



out_free:

	kvfree(cmp.src_pages);

	kvfree(cmp.dst_pages);



out_unlock:

	if (same_inode)

		inode_unlock(src);

	else

		btrfs_double_inode_unlock(src, dst);



out_free:

	kvfree(cmp.src_pages);

	kvfree(cmp.dst_pages);



	return ret;

}