summaryrefslogtreecommitdiff
path: root/fs
diff options
context:
space:
mode:
authorNikolay Borisov <nborisov@suse.com>2018-01-30 16:07:37 +0200
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>2018-03-22 09:18:01 +0100
commit8ae7720cf90b952b9dba9b1d31062068d29137ff (patch)
treedbbf21a1a68db75cc1784bbe401668f6f9458565 /fs
parent8890bae03f4dba1c2292e5445682b556af4e8f1b (diff)
btrfs: Fix use-after-free when cleaning up fs_devs with a single stale device
commit fd649f10c3d21ee9d7542c609f29978bdf73ab94 upstream. Commit 4fde46f0cc71 ("Btrfs: free the stale device") introduced btrfs_free_stale_device which iterates the device lists for all registered btrfs filesystems and deletes those devices which aren't mounted. In a btrfs_devices structure has only 1 device attached to it and it is unused then btrfs_free_stale_devices will proceed to also free the btrfs_fs_devices struct itself. Currently this leads to a use after free since list_for_each_entry will try to perform a check on the already freed memory to see if it has to terminate the loop. The fix is to use 'break' when we know we are freeing the current fs_devs. Fixes: 4fde46f0cc71 ("Btrfs: free the stale device") Signed-off-by: Nikolay Borisov <nborisov@suse.com> Reviewed-by: Anand Jain <anand.jain@oracle.com> Signed-off-by: David Sterba <dsterba@suse.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'fs')
-rw-r--r--fs/btrfs/volumes.c1
1 files changed, 1 insertions, 0 deletions
diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
index a73c29d2b315..5900508ca6ed 100644
--- a/fs/btrfs/volumes.c
+++ b/fs/btrfs/volumes.c
@@ -583,6 +583,7 @@ void btrfs_free_stale_device(struct btrfs_device *cur_dev)
btrfs_sysfs_remove_fsid(fs_devs);
list_del(&fs_devs->list);
free_fs_devices(fs_devs);
+ break;
} else {
fs_devs->num_devices--;
list_del(&dev->dev_list);