Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 4edc2ca3 authored by Dave Jones's avatar Dave Jones Committed by Chris Mason
Browse files

Btrfs: fix use-after-free in __btrfs_end_transaction 



49b25e05 introduced a use-after-free bug
that caused spurious -EIO's to be returned.

Do the check before we free the transaction.

Cc: David Sterba <dsterba@suse.cz>
Cc: Jeff Mahoney <jeffm@suse.com>
Signed-off-by: default avatarDave Jones <davej@redhat.com>
Signed-off-by: default avatarChris Mason <chris.mason@oracle.com>
parent e627ee7b

fs/btrfs/transaction.c

+5 −4
Original line number Diff line number Diff line
@@ -480,6 +480,7 @@ static int __btrfs_end_transaction(struct btrfs_trans_handle *trans, 
	struct btrfs_transaction *cur_trans = trans->transaction;

	struct btrfs_fs_info *info = root->fs_info;

	int count = 0;

	int err = 0;



	if (--trans->use_count) {

		trans->block_rsv = trans->orig_rsv;
@@ -532,18 +533,18 @@ static int __btrfs_end_transaction(struct btrfs_trans_handle *trans, 


	if (current->journal_info == trans)

		current->journal_info = NULL;

	memset(trans, 0, sizeof(*trans));

	kmem_cache_free(btrfs_trans_handle_cachep, trans);



	if (throttle)

		btrfs_run_delayed_iputs(root);



	if (trans->aborted ||

	    root->fs_info->fs_state & BTRFS_SUPER_FLAG_ERROR) {

		return -EIO;

		err = -EIO;

	}



	return 0;

	memset(trans, 0, sizeof(*trans));

	kmem_cache_free(btrfs_trans_handle_cachep, trans);

	return err;

}



int btrfs_end_transaction(struct btrfs_trans_handle *trans,