Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 0eeff236 authored by Liu Bo's avatar Liu Bo Committed by Chris Mason
Browse files

Btrfs: fix use-after-free in btrfs_replay_log 



@log_root_tree should not be referenced after kfree.

Signed-off-by: default avatarLiu Bo <bo.li.liu@oracle.com>
Reviewed-by: default avatarDavid Sterba <dsterba@suse.cz>
Reported-by: default avatarJulia Lawall <julia.lawall@lip6.fr>
Signed-off-by: default avatarChris Mason <clm@fb.com>
parent 9a4e7276

fs/btrfs/disk-io.c

+2 −1
Original line number Original line Diff line number Diff line
@@ -2321,8 +2321,9 @@ static int btrfs_replay_log(struct btrfs_fs_info *fs_info, 
			fs_info->generation + 1);

			fs_info->generation + 1);

	if (IS_ERR(log_tree_root->node)) {

	if (IS_ERR(log_tree_root->node)) {

		printk(KERN_ERR "BTRFS: failed to read log tree\n");

		printk(KERN_ERR "BTRFS: failed to read log tree\n");

		ret = PTR_ERR(log_tree_root->node);

		kfree(log_tree_root);

		kfree(log_tree_root);

		return PTR_ERR(log_tree_root->node);

		return ret;

	} else if (!extent_buffer_uptodate(log_tree_root->node)) {

	} else if (!extent_buffer_uptodate(log_tree_root->node)) {

		printk(KERN_ERR "BTRFS: failed to read log tree\n");

		printk(KERN_ERR "BTRFS: failed to read log tree\n");

		free_extent_buffer(log_tree_root->node);

		free_extent_buffer(log_tree_root->node);