diff options
| author | Dan Carpenter <dan.carpenter@oracle.com> | 2018-08-20 10:25:33 +0200 |
|---|---|---|
| committer | David Sterba <dsterba@suse.com> | 2018-08-23 17:37:27 +0200 |
| commit | b9b8a41adeff5666b402996020b698504c927353 (patch) | |
| tree | aeceb9763a86ff57b52915a88c7fbcf767a700dd | |
| parent | btrfs: btrfs_shrink_device should call commit transaction at the end (diff) | |
| download | linux-b9b8a41adeff5666b402996020b698504c927353.tar.xz linux-b9b8a41adeff5666b402996020b698504c927353.zip | |
btrfs: use after free in btrfs_quota_enable
The issue here is that btrfs_commit_transaction() frees "trans" on both
the error and the success path. So the problem would be if
btrfs_commit_transaction() succeeds, and then qgroup_rescan_init()
fails. That means that "ret" is non-zero and "trans" is non-NULL and it
leads to a use after free inside the btrfs_end_transaction() macro.
Fixes: 340f1aa27f36 ("btrfs: qgroups: Move transaction management inside btrfs_quota_enable/disable")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: Nikolay Borisov <nborisov@suse.com>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
| -rw-r--r-- | fs/btrfs/qgroup.c | 5 |
1 files changed, 2 insertions, 3 deletions
diff --git a/fs/btrfs/qgroup.c b/fs/btrfs/qgroup.c index 4353bb69bb86..d4917c0cddf5 100644 --- a/fs/btrfs/qgroup.c +++ b/fs/btrfs/qgroup.c @@ -1019,10 +1019,9 @@ out_add_root: spin_unlock(&fs_info->qgroup_lock); ret = btrfs_commit_transaction(trans); - if (ret) { - trans = NULL; + trans = NULL; + if (ret) goto out_free_path; - } ret = qgroup_rescan_init(fs_info, 0, 1); if (!ret) { |