Re: [PATCH] btrfs: fix NULL pointer dereference from free_reloc_roots()
From: Nikolay Borisov <hidden>
Date: 2017-08-25 05:49:14
On 25.08.2017 08:15, Naohiro Aota wrote:
__del_reloc_root should be called before freeing up reloc_root->node. If not, calling __del_reloc_root() dereference reloc_root->node, causing the system BUG. Signed-off-by: Naohiro Aota <naohiro.aota@wdc.com>
This patch should also have:
Fixes: 6bdf131fac23 ("Btrfs: don't leak reloc root nodes on error")
Cc: <redacted> # 4.9
With that:
Reviewed-by: Nikolay Borisov <redacted>
quoted hunk ↗ jump to hunk
--- fs/btrfs/relocation.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)diff --git a/fs/btrfs/relocation.c b/fs/btrfs/relocation.c index 65661d1aae4e..6445de8e9ece 100644 --- a/fs/btrfs/relocation.c +++ b/fs/btrfs/relocation.c@@ -2393,11 +2393,11 @@ void free_reloc_roots(struct list_head *list) while (!list_empty(list)) { reloc_root = list_entry(list->next, struct btrfs_root, root_list); + __del_reloc_root(reloc_root); free_extent_buffer(reloc_root->node); free_extent_buffer(reloc_root->commit_root); reloc_root->node = NULL; reloc_root->commit_root = NULL; - __del_reloc_root(reloc_root); } } --To unsubscribe from this list: send the line "unsubscribe linux-btrfs" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html