Commit 7b5ff90e authored Jun 06, 2013 by Josef Bacik Committed by Chris Mason Jun 08, 2013

Btrfs: don't delete fs_roots until after we cleanup the transaction



We get a use after free if we had a transaction to cleanup since there could be
delayed inodes which refer to their respective fs_root.  Thanks

Reported-by: David Sterba <dsterba@suse.cz>
Signed-off-by: Josef Bacik <jbacik@fusionio.com>
Signed-off-by: Chris Mason <chris.mason@fusionio.com>

parent c5cb6a05

fs/btrfs/disk-io.c

+1 −1

Original line number	Diff line number	Diff line
		@@ -2859,8 +2859,8 @@ fail_qgroup:
		btrfs_free_qgroup_config(fs_info);
		fail_trans_kthread:
		kthread_stop(fs_info->transaction_kthread);
		del_fs_roots(fs_info);
		btrfs_cleanup_transaction(fs_info->tree_root);
		del_fs_roots(fs_info);
		fail_cleaner:
		kthread_stop(fs_info->cleaner_kthread);