Thread (9 messages) 9 messages, 3 authors, 2012-06-26

Re: [patch] Btrfs: dereferencing free'd memory in panic message

From: Josef Bacik <hidden>
Date: 2012-06-22 13:09:12
Also in: linux-btrfs

On 06/22/2012 03:14 AM, Dan Carpenter wrote:
quoted hunk ↗ jump to hunk
We free "node" and then dereference it in the panic message on the next
line.  I considered moving the kfree() after the panic given that panic
can return under certain configurations, but in the end I decided it
doesn't matter if we leak a bit after a panic.

Signed-off-by: Dan Carpenter <redacted>
diff --git a/fs/btrfs/relocation.c b/fs/btrfs/relocation.c
index 790f492..c50d80a 100644
--- a/fs/btrfs/relocation.c
+++ b/fs/btrfs/relocation.c
@@ -1239,7 +1239,6 @@ static int __must_check __add_reloc_root(struct btrfs_root *root)
  			      node->bytenr, &node->rb_node);
  	spin_unlock(&rc->reloc_root_tree.lock);
  	if (rb_node) {
-		kfree(node);
  		btrfs_panic(root->fs_info, -EEXIST, "Duplicate root found "
  			    "for start=%llu while inserting into relocation "
  			    "tree\n", node->bytenr);
Except btrfs_panic can not panic the box if it's mounted to not panic on 
errors, so we still need to do the kfree afterwards.  Thanks,

Josef
Keyboard shortcuts
hback out one level
jnext message in thread
kprevious message in thread
ldrill in
Escclose help / fold thread tree
?toggle this help