xfs: fix double-cleanup when CUI recovery fails
commit 7a21272b08
upstream.
Dan Carpenter reported a double-free of rcur if _defer_finish fails
while we're recovering CUI items. Fix the error recovery to prevent
this.
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
Cc: Christoph Hellwig <hch@lst.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
parent
aa38f370b2
commit
d9c7c9fa60
|
@ -526,13 +526,14 @@ xfs_cui_recover(
|
||||||
xfs_refcount_finish_one_cleanup(tp, rcur, error);
|
xfs_refcount_finish_one_cleanup(tp, rcur, error);
|
||||||
error = xfs_defer_finish(&tp, &dfops, NULL);
|
error = xfs_defer_finish(&tp, &dfops, NULL);
|
||||||
if (error)
|
if (error)
|
||||||
goto abort_error;
|
goto abort_defer;
|
||||||
set_bit(XFS_CUI_RECOVERED, &cuip->cui_flags);
|
set_bit(XFS_CUI_RECOVERED, &cuip->cui_flags);
|
||||||
error = xfs_trans_commit(tp);
|
error = xfs_trans_commit(tp);
|
||||||
return error;
|
return error;
|
||||||
|
|
||||||
abort_error:
|
abort_error:
|
||||||
xfs_refcount_finish_one_cleanup(tp, rcur, error);
|
xfs_refcount_finish_one_cleanup(tp, rcur, error);
|
||||||
|
abort_defer:
|
||||||
xfs_defer_cancel(&dfops);
|
xfs_defer_cancel(&dfops);
|
||||||
xfs_trans_cancel(tp);
|
xfs_trans_cancel(tp);
|
||||||
return error;
|
return error;
|
||||||
|
|
Loading…
Reference in a new issue