From patchwork Tue Feb 12 16:27:46 2013 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ilya Dryomov X-Patchwork-Id: 2129381 Return-Path: X-Original-To: patchwork-linux-btrfs@patchwork.kernel.org Delivered-To: patchwork-process-083081@patchwork2.kernel.org Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by patchwork2.kernel.org (Postfix) with ESMTP id D0412DF23E for ; Tue, 12 Feb 2013 16:27:59 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S932282Ab3BLQ14 (ORCPT ); Tue, 12 Feb 2013 11:27:56 -0500 Received: from mail-ea0-f180.google.com ([209.85.215.180]:60678 "EHLO mail-ea0-f180.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1758571Ab3BLQ1z (ORCPT ); Tue, 12 Feb 2013 11:27:55 -0500 Received: by mail-ea0-f180.google.com with SMTP id c1so110580eaa.25 for ; Tue, 12 Feb 2013 08:27:52 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=x-received:from:to:cc:subject:date:message-id:x-mailer; bh=4SSdZzYKo5HbMv2NxC7cXdYHfFLdXOzdqT9alWEkIvk=; b=XARIp1mGcyDeO1nUMeefqHlwf0pRGJ/IcjgIcc3c9nPh7NvTWA1Jb2WC81n3ycpYaK /ftse4yOHLoIflukI3nLGMieum4qYcI436GNTvQV7RMv4+T6OGwW+ulbxei4kZ8/y4En i6hTzKpkRQHEZ7RVU53opXFwH/UdDypYgYaoseY2BTItczxkE2kfHdkdck4++0IcsRIf aFl/ealO9aDc6O+YXiIEbaMjWd+jI39GPYPJrESxzQbTDd/osg7lxrRIDchTSPI+M4ZW E1VyjG+9n/+RPCaZualqPqutrR3BkJeQ22htUVMDEDSqTMv2GCRuVpICiZhqJS4QMsi+ uhHw== X-Received: by 10.14.218.132 with SMTP id k4mr64805402eep.27.1360686471417; Tue, 12 Feb 2013 08:27:51 -0800 (PST) Received: from localhost ([109.110.82.161]) by mx.google.com with ESMTPS id q42sm59425040eem.14.2013.02.12.08.27.49 (version=TLSv1.2 cipher=RC4-SHA bits=128/128); Tue, 12 Feb 2013 08:27:50 -0800 (PST) From: Ilya Dryomov To: linux-btrfs@vger.kernel.org Cc: Chris Mason , idryomov@gmail.com Subject: [PATCH] Btrfs: eliminate a use-after-free in btrfs_balance() Date: Tue, 12 Feb 2013 18:27:46 +0200 Message-Id: <1360686466-22638-1-git-send-email-idryomov@gmail.com> X-Mailer: git-send-email 1.7.9.1 Sender: linux-btrfs-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-btrfs@vger.kernel.org Commit 5af3e8cc introduced a use-after-free at volumes.c:3139: bctl is freed above in __cancel_balance() in all cases except for balance pause. Fix this by moving the offending check a couple statements above, the meaning of the check is preserved. Reported-by: Chris Mason Signed-off-by: Ilya Dryomov --- fs/btrfs/volumes.c | 10 +++++----- 1 files changed, 5 insertions(+), 5 deletions(-) diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c index 15f6efd..5d25aed 100644 --- a/fs/btrfs/volumes.c +++ b/fs/btrfs/volumes.c @@ -3126,6 +3126,11 @@ int btrfs_balance(struct btrfs_balance_control *bctl, mutex_lock(&fs_info->balance_mutex); atomic_dec(&fs_info->balance_running); + if (bctl->sys.flags & BTRFS_BALANCE_ARGS_CONVERT) { + fs_info->num_tolerated_disk_barrier_failures = + btrfs_calc_num_tolerated_disk_barrier_failures(fs_info); + } + if (bargs) { memset(bargs, 0, sizeof(*bargs)); update_ioctl_balance_args(fs_info, 0, bargs); @@ -3136,11 +3141,6 @@ int btrfs_balance(struct btrfs_balance_control *bctl, __cancel_balance(fs_info); } - if (bctl->sys.flags & BTRFS_BALANCE_ARGS_CONVERT) { - fs_info->num_tolerated_disk_barrier_failures = - btrfs_calc_num_tolerated_disk_barrier_failures(fs_info); - } - wake_up(&fs_info->balance_wait_q); return ret;