diff options
| author | Qu Wenruo <[email protected]> | 2017-03-29 01:33:22 +0000 |
|---|---|---|
| committer | David Sterba <[email protected]> | 2017-04-18 12:07:26 +0000 |
| commit | e501bfe323356ea3f7ef79d4b0d95389b70a7193 (patch) | |
| tree | 870724f193b99f9388dce8e7cbdfcb96b3cfeed5 /fs/btrfs/dev-replace.c | |
| parent | btrfs: Wait for in-flight bios before freeing target device for raid56 (diff) | |
| download | kernel-e501bfe323356ea3f7ef79d4b0d95389b70a7193.tar.gz kernel-e501bfe323356ea3f7ef79d4b0d95389b70a7193.zip | |
btrfs: Prevent scrub recheck from racing with dev replace
scrub_setup_recheck_block() calls btrfs_map_sblock() and then accesses
bbio without protection of bio_counter.
This can lead to use-after-free if racing with dev replace cancel.
Fix it by increasing bio_counter before calling btrfs_map_sblock() and
decreasing the bio_counter when corresponding recover is finished.
Cc: Liu Bo <[email protected]>
Reported-by: Liu Bo <[email protected]>
Signed-off-by: Qu Wenruo <[email protected]>
Signed-off-by: David Sterba <[email protected]>
Diffstat (limited to 'fs/btrfs/dev-replace.c')
0 files changed, 0 insertions, 0 deletions