Btrfs: eliminate a use-after-free in btrfs_balance()
Commit 5af3e8cc
introduced a use-after-free at volumes.c:3139: bctl is freed
above in __cancel_balance() in all cases except for balance pause. Fix this
by moving the offending check a couple statements above, the meaning of the
check is preserved.
Reported-by: Chris Mason <chris.mason@fusionio.com>
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Signed-off-by: Josef Bacik <jbacik@fusionio.com>
This commit is contained in:
parent
c8f2f24bd5
commit
bf023ecfca
|
@ -3195,6 +3195,11 @@ int btrfs_balance(struct btrfs_balance_control *bctl,
|
||||||
mutex_lock(&fs_info->balance_mutex);
|
mutex_lock(&fs_info->balance_mutex);
|
||||||
atomic_dec(&fs_info->balance_running);
|
atomic_dec(&fs_info->balance_running);
|
||||||
|
|
||||||
|
if (bctl->sys.flags & BTRFS_BALANCE_ARGS_CONVERT) {
|
||||||
|
fs_info->num_tolerated_disk_barrier_failures =
|
||||||
|
btrfs_calc_num_tolerated_disk_barrier_failures(fs_info);
|
||||||
|
}
|
||||||
|
|
||||||
if (bargs) {
|
if (bargs) {
|
||||||
memset(bargs, 0, sizeof(*bargs));
|
memset(bargs, 0, sizeof(*bargs));
|
||||||
update_ioctl_balance_args(fs_info, 0, bargs);
|
update_ioctl_balance_args(fs_info, 0, bargs);
|
||||||
|
@ -3205,11 +3210,6 @@ int btrfs_balance(struct btrfs_balance_control *bctl,
|
||||||
__cancel_balance(fs_info);
|
__cancel_balance(fs_info);
|
||||||
}
|
}
|
||||||
|
|
||||||
if (bctl->sys.flags & BTRFS_BALANCE_ARGS_CONVERT) {
|
|
||||||
fs_info->num_tolerated_disk_barrier_failures =
|
|
||||||
btrfs_calc_num_tolerated_disk_barrier_failures(fs_info);
|
|
||||||
}
|
|
||||||
|
|
||||||
wake_up(&fs_info->balance_wait_q);
|
wake_up(&fs_info->balance_wait_q);
|
||||||
|
|
||||||
return ret;
|
return ret;
|
||||||
|
|
Loading…
Reference in a new issue