diff options
| author | Pan Bian <bianpan2016@163.com> | 2018-11-23 18:10:15 +0800 |
|---|---|---|
| committer | David Sterba <dsterba@suse.com> | 2018-11-23 13:47:46 +0100 |
| commit | 42a657f57628402c73237547f0134e083e2f6764 (patch) | |
| tree | aa02b77126d89e53e9938401c5be448e87eb14b3 /fs/btrfs/file.c | |
| parent | 552f0329c75b3e1d7f9bb8c9e421d37403f192cd (diff) | |
| download | linux-42a657f57628402c73237547f0134e083e2f6764.tar.bz2 | |
btrfs: relocation: set trans to be NULL after ending transaction
The function relocate_block_group calls btrfs_end_transaction to release
trans when update_backref_cache returns 1, and then continues the loop
body. If btrfs_block_rsv_refill fails this time, it will jump out the
loop and the freed trans will be accessed. This may result in a
use-after-free bug. The patch assigns NULL to trans after trans is
released so that it will not be accessed.
Fixes: 0647bf564f1 ("Btrfs: improve forever loop when doing balance relocation")
CC: stable@vger.kernel.org # 4.4+
Reviewed-by: Qu Wenruo <wqu@suse.com>
Signed-off-by: Pan Bian <bianpan2016@163.com>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Diffstat (limited to 'fs/btrfs/file.c')
0 files changed, 0 insertions, 0 deletions