Commit 6e5aafb2 authored Nov 04, 2014 by Chris Mason

Btrfs: fix kfree on list_head in btrfs_lookup_csums_range error cleanup



If we hit any errors in btrfs_lookup_csums_range, we'll loop through all
the csums we allocate and free them.  But the code was using list_entry
incorrectly, and ended up trying to free the on-stack list_head instead.

This bug came from commit 0678b618

btrfs: Don't BUG_ON kzalloc error in btrfs_lookup_csums_range()

Signed-off-by: Chris Mason <clm@fb.com>
Reported-by: Erik Berg <btrfs@slipsprogrammoer.no>
cc: stable@vger.kernel.org # 3.3 or newer

parent d05a2b4c

fs/btrfs/file-item.c

+1 −1

Original line number	Diff line number	Diff line
		@@ -413,7 +413,7 @@ int btrfs_lookup_csums_range(struct btrfs_root *root, u64 start, u64 end,
		ret = 0;
		fail:
		while (ret < 0 && !list_empty(&tmplist)) {
		sums = list_entry(&tmplist, struct btrfs_ordered_sum, list);
		sums = list_entry(tmplist.next, struct btrfs_ordered_sum, list);
		list_del(&sums->list);
		kfree(sums);
		}