diff options
| author | Dan Carpenter <[email protected]> | 2018-08-20 08:25:33 +0000 |
|---|---|---|
| committer | David Sterba <[email protected]> | 2018-08-23 15:37:27 +0000 |
| commit | b9b8a41adeff5666b402996020b698504c927353 (patch) | |
| tree | aeceb9763a86ff57b52915a88c7fbcf767a700dd /arch/powerpc/lib/code-patching.c | |
| parent | btrfs: btrfs_shrink_device should call commit transaction at the end (diff) | |
| download | kernel-b9b8a41adeff5666b402996020b698504c927353.tar.gz kernel-b9b8a41adeff5666b402996020b698504c927353.zip | |
btrfs: use after free in btrfs_quota_enable
The issue here is that btrfs_commit_transaction() frees "trans" on both
the error and the success path. So the problem would be if
btrfs_commit_transaction() succeeds, and then qgroup_rescan_init()
fails. That means that "ret" is non-zero and "trans" is non-NULL and it
leads to a use after free inside the btrfs_end_transaction() macro.
Fixes: 340f1aa27f36 ("btrfs: qgroups: Move transaction management inside btrfs_quota_enable/disable")
Signed-off-by: Dan Carpenter <[email protected]>
Reviewed-by: Nikolay Borisov <[email protected]>
Reviewed-by: David Sterba <[email protected]>
Signed-off-by: David Sterba <[email protected]>
Diffstat (limited to 'arch/powerpc/lib/code-patching.c')
0 files changed, 0 insertions, 0 deletions