Skip to content

Commit

Permalink
Btrfs: eliminate a use-after-free in btrfs_balance()
Browse files Browse the repository at this point in the history
Commit 5af3e8c introduced a use-after-free at volumes.c:3139: bctl is freed
above in __cancel_balance() in all cases except for balance pause.  Fix this
by moving the offending check a couple statements above, the meaning of the
check is preserved.

Reported-by: Chris Mason <chris.mason@fusionio.com>
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Signed-off-by: Josef Bacik <jbacik@fusionio.com>
  • Loading branch information
Ilya Dryomov authored and Josef Bacik committed Feb 20, 2013
1 parent c8f2f24 commit bf023ec
Showing 1 changed file with 5 additions and 5 deletions.
10 changes: 5 additions & 5 deletions fs/btrfs/volumes.c
Original file line number Diff line number Diff line change
Expand Up @@ -3195,6 +3195,11 @@ int btrfs_balance(struct btrfs_balance_control *bctl,
mutex_lock(&fs_info->balance_mutex);
atomic_dec(&fs_info->balance_running);

if (bctl->sys.flags & BTRFS_BALANCE_ARGS_CONVERT) {
fs_info->num_tolerated_disk_barrier_failures =
btrfs_calc_num_tolerated_disk_barrier_failures(fs_info);
}

if (bargs) {
memset(bargs, 0, sizeof(*bargs));
update_ioctl_balance_args(fs_info, 0, bargs);
Expand All @@ -3205,11 +3210,6 @@ int btrfs_balance(struct btrfs_balance_control *bctl,
__cancel_balance(fs_info);
}

if (bctl->sys.flags & BTRFS_BALANCE_ARGS_CONVERT) {
fs_info->num_tolerated_disk_barrier_failures =
btrfs_calc_num_tolerated_disk_barrier_failures(fs_info);
}

wake_up(&fs_info->balance_wait_q);

return ret;
Expand Down

0 comments on commit bf023ec

Please sign in to comment.