diff options
| author | Jeff Mahoney <jeffm@suse.com> | 2011-10-04 05:23:23 +0200 |
|---|---|---|
| committer | David Sterba <dsterba@suse.cz> | 2012-03-22 01:45:30 +0100 |
| commit | cddcd800189bc03745d576f913dc57692c6f439a (patch) | |
| tree | 361ed5f8c26a9820608de6d0a74f546729c90970 /fs/btrfs/delayed-ref.c | |
| parent | btrfs: Panic on bad rbtree operations (diff) | |
| download | linux-cddcd800189bc03745d576f913dc57692c6f439a.tar.xz linux-cddcd800189bc03745d576f913dc57692c6f439a.zip | |
btrfs: Fix kfree of member instead of structure
Correctness fix: The kfree calls in the add_delayed_* functions free
the node that's passed into it, but the node is a member of another
structure. It works because it's always the first member of the
containing structure, but it should really be using the containing
structure itself.
Signed-off-by: Jeff Mahoney <jeffm@suse.com>
Diffstat (limited to 'fs/btrfs/delayed-ref.c')
| -rw-r--r-- | fs/btrfs/delayed-ref.c | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/fs/btrfs/delayed-ref.c b/fs/btrfs/delayed-ref.c index 66e4f29505a3..29ecd543d807 100644 --- a/fs/btrfs/delayed-ref.c +++ b/fs/btrfs/delayed-ref.c @@ -487,7 +487,7 @@ static noinline int add_delayed_ref_head(struct btrfs_fs_info *fs_info, * we've updated the existing ref, free the newly * allocated ref */ - kfree(ref); + kfree(head_ref); } else { delayed_refs->num_heads++; delayed_refs->num_heads_ready++; @@ -549,7 +549,7 @@ static noinline int add_delayed_tree_ref(struct btrfs_fs_info *fs_info, * we've updated the existing ref, free the newly * allocated ref */ - kfree(ref); + kfree(full_ref); } else { delayed_refs->num_entries++; trans->delayed_ref_updates++; @@ -611,7 +611,7 @@ static noinline int add_delayed_data_ref(struct btrfs_fs_info *fs_info, * we've updated the existing ref, free the newly * allocated ref */ - kfree(ref); + kfree(full_ref); } else { delayed_refs->num_entries++; trans->delayed_ref_updates++; |