btrfs/raid56: fix and cleanup some error paths
The alloc_rbio() frees "raid_map" and "bbio" on error, so there is a potential double free bug in raid56_parity_write(). The raid56_parity_write() and raid56_parity_recover() functions should still free "raid_map" and "bbio" on error if other errors occur though, so I have added some more calls to kfree(). Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Reviewed-by: Miao Xie <miaox@cn.fujitsu.com> Signed-off-by: Josef Bacik <jbacik@fusionio.com> Signed-off-by: Chris Mason <chris.mason@fusionio.com>
This commit is contained in:
parent
2112ac800d
commit
3dc0e818af
|
@ -1687,11 +1687,8 @@ int raid56_parity_write(struct btrfs_root *root, struct bio *bio,
|
||||||
struct blk_plug_cb *cb;
|
struct blk_plug_cb *cb;
|
||||||
|
|
||||||
rbio = alloc_rbio(root, bbio, raid_map, stripe_len);
|
rbio = alloc_rbio(root, bbio, raid_map, stripe_len);
|
||||||
if (IS_ERR(rbio)) {
|
if (IS_ERR(rbio))
|
||||||
kfree(raid_map);
|
|
||||||
kfree(bbio);
|
|
||||||
return PTR_ERR(rbio);
|
return PTR_ERR(rbio);
|
||||||
}
|
|
||||||
bio_list_add(&rbio->bio_list, bio);
|
bio_list_add(&rbio->bio_list, bio);
|
||||||
rbio->bio_list_bytes = bio->bi_size;
|
rbio->bio_list_bytes = bio->bi_size;
|
||||||
|
|
||||||
|
@ -2041,9 +2038,8 @@ int raid56_parity_recover(struct btrfs_root *root, struct bio *bio,
|
||||||
int ret;
|
int ret;
|
||||||
|
|
||||||
rbio = alloc_rbio(root, bbio, raid_map, stripe_len);
|
rbio = alloc_rbio(root, bbio, raid_map, stripe_len);
|
||||||
if (IS_ERR(rbio)) {
|
if (IS_ERR(rbio))
|
||||||
return PTR_ERR(rbio);
|
return PTR_ERR(rbio);
|
||||||
}
|
|
||||||
|
|
||||||
rbio->read_rebuild = 1;
|
rbio->read_rebuild = 1;
|
||||||
bio_list_add(&rbio->bio_list, bio);
|
bio_list_add(&rbio->bio_list, bio);
|
||||||
|
@ -2052,6 +2048,8 @@ int raid56_parity_recover(struct btrfs_root *root, struct bio *bio,
|
||||||
rbio->faila = find_logical_bio_stripe(rbio, bio);
|
rbio->faila = find_logical_bio_stripe(rbio, bio);
|
||||||
if (rbio->faila == -1) {
|
if (rbio->faila == -1) {
|
||||||
BUG();
|
BUG();
|
||||||
|
kfree(raid_map);
|
||||||
|
kfree(bbio);
|
||||||
kfree(rbio);
|
kfree(rbio);
|
||||||
return -EIO;
|
return -EIO;
|
||||||
}
|
}
|
||||||
|
|
Loading…
Reference in a new issue