hollalinux
/
linux-sg2042
mirror of https://github.com/sophgo/linux-riscv.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Btrfs: fix use-after-free when cloning a trailing file hole 

The transaction handle was being used after being freed.

Cc: Chris Mason <clm@fb.com>
Signed-off-by: Filipe David Borba Manana <fdmanana@gmail.com>
Signed-off-by: Chris Mason <clm@fb.com>
This commit is contained in:
Filipe Manana 2014-06-29 21:45:40 +01:00 committed by Chris Mason
parent 0aeb8a6e67
commit 14f5979633
1 changed files with 9 additions and 11 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

20
fs/btrfs/ioctl.c
View File

@ -3142,7 +3142,6 @@ out:
static void clone_update_extent_map(struct inode *inode, static void clone_update_extent_map(struct inode *inode,
const struct btrfs_trans_handle *trans, const struct btrfs_trans_handle *trans,
const struct btrfs_path *path, const struct btrfs_path *path,
struct btrfs_file_extent_item *fi,
const u64 hole_offset, const u64 hole_offset,
const u64 hole_len) const u64 hole_len)
{ {
@ -3157,7 +3156,11 @@ static void clone_update_extent_map(struct inode *inode,
return; return;
} }
if (fi) { if (path) {
struct btrfs_file_extent_item *fi;
fi = btrfs_item_ptr(path->nodes[0], path->slots[0],
struct btrfs_file_extent_item);
btrfs_extent_item_to_extent_map(inode, path, fi, false, em); btrfs_extent_item_to_extent_map(inode, path, fi, false, em);
em->generation = -1; em->generation = -1;
if (btrfs_file_extent_type(path->nodes[0], fi) == if (btrfs_file_extent_type(path->nodes[0], fi) ==
@ -3511,18 +3514,15 @@ process_slot:
btrfs_item_ptr_offset(leaf, slot), btrfs_item_ptr_offset(leaf, slot),
size); size);
inode_add_bytes(inode, datal); inode_add_bytes(inode, datal);
extent = btrfs_item_ptr(leaf, slot,
struct btrfs_file_extent_item);
} }
/* If we have an implicit hole (NO_HOLES feature). */ /* If we have an implicit hole (NO_HOLES feature). */
if (drop_start < new_key.offset) if (drop_start < new_key.offset)
clone_update_extent_map(inode, trans, clone_update_extent_map(inode, trans,
path, NULL, drop_start, NULL, drop_start,
new_key.offset - drop_start); new_key.offset - drop_start);
clone_update_extent_map(inode, trans, path, clone_update_extent_map(inode, trans, path, 0, 0);
extent, 0, 0);
btrfs_mark_buffer_dirty(leaf); btrfs_mark_buffer_dirty(leaf);
btrfs_release_path(path); btrfs_release_path(path);
@ -3565,12 +3565,10 @@ process_slot:
btrfs_end_transaction(trans, root); btrfs_end_transaction(trans, root);
goto out; goto out;
} }
clone_update_extent_map(inode, trans, NULL, last_dest_end,
destoff + len - last_dest_end);
ret = clone_finish_inode_update(trans, inode, destoff + len, ret = clone_finish_inode_update(trans, inode, destoff + len,
destoff, olen); destoff, olen);
if (ret)
goto out;
clone_update_extent_map(inode, trans, path, NULL, last_dest_end,
destoff + len - last_dest_end);
} }
out: out: