Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 9a7d93dd authored by Naohiro Aota's avatar Naohiro Aota Committed by Greg Kroah-Hartman
Browse files

btrfs: fix NULL pointer dereference from free_reloc_roots() 



commit bb166d7207432d3c7d10c45dc052f12ba3a2121d upstream.

__del_reloc_root should be called before freeing up reloc_root->node.
If not, calling __del_reloc_root() dereference reloc_root->node, causing
the system BUG.

Fixes: 6bdf131fac23 ("Btrfs: don't leak reloc root nodes on error")
Signed-off-by: default avatarNaohiro Aota <naohiro.aota@wdc.com>
Reviewed-by: default avatarNikolay Borisov <nborisov@suse.com>
Reviewed-by: default avatarDavid Sterba <dsterba@suse.com>
Signed-off-by: default avatarDavid Sterba <dsterba@suse.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent b08dc7d4

fs/btrfs/relocation.c

+1 −1
Original line number Diff line number Diff line
@@ -2350,11 +2350,11 @@ void free_reloc_roots(struct list_head *list) 
	while (!list_empty(list)) {

		reloc_root = list_entry(list->next, struct btrfs_root,

					root_list);

		__del_reloc_root(reloc_root);

		free_extent_buffer(reloc_root->node);

		free_extent_buffer(reloc_root->commit_root);

		reloc_root->node = NULL;

		reloc_root->commit_root = NULL;

		__del_reloc_root(reloc_root);

	}

}