Commit eb1716af authored May 28, 2013 by Jan Schmidt Committed by Josef Bacik Jun 14, 2013

Btrfs: avoid double free of fs_info->qgroup_ulist



When btrfs_read_qgroup_config or btrfs_quota_enable return non-zero, we've
already freed the fs_info->qgroup_ulist. The final btrfs_free_qgroup_config
called from quota_disable makes another ulist_free(fs_info->qgroup_ulist)
call.

We set fs_info->qgroup_ulist to NULL on the mentioned error paths, turning
the ulist_free in btrfs_free_qgroup_config into a noop.

Cc: Wang Shilong <wangsl-fnst@cn.fujitsu.com>
Signed-off-by: Jan Schmidt <list.btrfs@jan-o-sch.net>
Signed-off-by: Josef Bacik <jbacik@fusionio.com>

parent 4373519d

fs/btrfs/qgroup.c

+6 −2

Original line number	Original line	Diff line number	Diff line
	@@ -430,8 +430,10 @@ out:
	}		}
	btrfs_free_path(path);		btrfs_free_path(path);

	if (ret < 0)		if (ret < 0) {
	ulist_free(fs_info->qgroup_ulist);		ulist_free(fs_info->qgroup_ulist);
			fs_info->qgroup_ulist = NULL;
			}

	return ret < 0 ? ret : 0;		return ret < 0 ? ret : 0;
	}		}
	@@ -932,8 +934,10 @@ out_free_root:
	kfree(quota_root);		kfree(quota_root);
	}		}
	out:		out:
	if (ret)		if (ret) {
	ulist_free(fs_info->qgroup_ulist);		ulist_free(fs_info->qgroup_ulist);
			fs_info->qgroup_ulist = NULL;
			}
	mutex_unlock(&fs_info->qgroup_ioctl_lock);		mutex_unlock(&fs_info->qgroup_ioctl_lock);
	return ret;		return ret;
	}		}