Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit adfa97cb authored by Ilya Dryomov's avatar Ilya Dryomov Committed by Chris Mason
Browse files

Btrfs: don't leak ioctl args in btrfs_ioctl_dev_replace 



struct btrfs_ioctl_dev_replace_args memory is leaked if replace is
requested on a read-only filesystem.  Fix it.

Signed-off-by: default avatarIlya Dryomov <idryomov@gmail.com>
Signed-off-by: default avatarJosef Bacik <jbacik@fusionio.com>
Signed-off-by: default avatarChris Mason <chris.mason@fusionio.com>
parent f747cab7

fs/btrfs/ioctl.c

+5 −4
Original line number Diff line number Diff line
@@ -3667,9 +3667,10 @@ static long btrfs_ioctl_dev_replace(struct btrfs_root *root, void __user *arg) 


	switch (p->cmd) {

	case BTRFS_IOCTL_DEV_REPLACE_CMD_START:

		if (root->fs_info->sb->s_flags & MS_RDONLY)

			return -EROFS;



		if (root->fs_info->sb->s_flags & MS_RDONLY) {

			ret = -EROFS;

			goto out;

		}

		if (atomic_xchg(

			&root->fs_info->mutually_exclusive_operation_running,

			1)) {
@@ -3695,7 +3696,7 @@ static long btrfs_ioctl_dev_replace(struct btrfs_root *root, void __user *arg) 


	if (copy_to_user(arg, p, sizeof(*p)))

		ret = -EFAULT;



out:

	kfree(p);

	return ret;

}