kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-16 22:39:48 +00:00
Code Issues Releases Packages Activity
linux/fs/btrfs
History
Pan Bian 225ef25362 btrfs: relocation: set trans to be NULL after ending transaction 
commit 42a657f576 upstream.

The function relocate_block_group calls btrfs_end_transaction to release
trans when update_backref_cache returns 1, and then continues the loop
body. If btrfs_block_rsv_refill fails this time, it will jump out the
loop and the freed trans will be accessed. This may result in a
use-after-free bug. The patch assigns NULL to trans after trans is
released so that it will not be accessed.

Fixes: 0647bf564f ("Btrfs: improve forever loop when doing balance relocation")
Reviewed-by: Qu Wenruo <wqu@suse.com>
Signed-off-by: Pan Bian <bianpan2016@163.com>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
[bwh: Backported to 3.16: adjust context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
History 2019-02-11 17:54:10 +00:00
..
tests btrfs: tests/qgroup: Fix wrong tree backref level 2018-10-21 08:45:07 +01:00
acl.c btrfs: preserve i_mode if __btrfs_set_acl() fails 2017-10-12 15:28:09 +01:00
async-thread.c btrfs: limit async_work allocation and worker func duration 2017-03-16 02:26:36 +00:00
async-thread.h btrfs: limit async_work allocation and worker func duration 2017-03-16 02:26:36 +00:00
backref.c btrfs: remove spurious WARN_ON(ref->count < 0) in find_parent_nodes 2018-06-16 22:22:05 +01:00
backref.h Btrfs: fix scrub_print_warning to handle skinny metadata extents 2014-06-09 17:21:17 -07:00
btrfs_inode.h btrfs: disable strict file flushes for renames and truncates 2014-09-05 16:36:37 -07:00
check-integrity.c btrfs: check_int: propagate out-of-memory error upwards 2014-06-09 17:20:21 -07:00
check-integrity.h block: submit_bio_wait() conversions 2013-11-24 16:33:41 -07:00
compression.c btrfs: zero out left over bytes after processing compression streams 2014-12-10 17:15:43 +00:00
compression.h btrfs: zero out left over bytes after processing compression streams 2014-12-10 17:15:43 +00:00
ctree.c Btrfs: send, fix invalid access to commit roots due to concurrent snapshotting 2018-10-21 08:46:05 +01:00
ctree.h btrfs: bugfix: handle FS_IOC32_{GETFLAGS,SETFLAGS,GETVERSION} in btrfs_ioctl 2016-08-22 22:37:52 +01:00
delayed-inode.c btrfs: limit async_work allocation and worker func duration 2017-03-16 02:26:36 +00:00
delayed-inode.h btrfs: properly set the termination value of ctx->pos in readdir 2016-02-25 10:34:58 +00:00
delayed-ref.c Btrfs: rework qgroup accounting 2014-06-09 17:20:48 -07:00
delayed-ref.h Btrfs: rework qgroup accounting 2014-06-09 17:20:48 -07:00
dev-replace.c btrfs: fix error handling in btrfs_dev_replace_start 2019-02-11 17:53:32 +00:00
dev-replace.h Btrfs: add new sources for device replace code 2012-12-12 17:15:41 -05:00
dir-item.c Btrfs: make xattr replace operations atomic 2015-03-30 11:11:47 +01:00
disk-io.c btrfs: Always try all copies when reading extent buffers 2019-02-11 17:54:03 +00:00
disk-io.h Btrfs: add sanity tests for new qgroup accounting code 2014-06-09 17:20:49 -07:00
export.c btrfs: remove fs/btrfs/compat.h 2013-11-11 22:03:19 -05:00
export.h NFS support for btrfs - v3 2008-09-25 11:04:06 -04:00
extent-tree.c btrfs: wait on caching when putting the bg cache 2019-02-11 17:53:32 +00:00
extent_io.c btrfs: fix incorrect error return ret being passed to mapping_set_error 2017-09-15 18:29:39 +01:00
extent_io.h Btrfs: remove unused wait queue in struct extent_buffer 2014-06-19 14:20:28 -07:00
extent_map.c Btrfs: do not move em to modified list when unpinning 2015-01-05 13:48:52 +00:00
extent_map.h Btrfs: fix NULL pointer crash when running balance and scrub concurrently 2014-06-19 14:20:55 -07:00
file-item.c Btrfs: fix kfree on list_head in btrfs_lookup_csums_range error cleanup 2014-11-14 15:19:58 +00:00
file.c Btrfs: don't clean dirty pages during buffered writes 2019-02-11 17:53:33 +00:00
free-space-cache.c Btrfs: fix use-after-free when dumping free space 2019-02-11 17:53:39 +00:00
free-space-cache.h Btrfs: remove path arg from btrfs_truncate_free_space_cache 2013-11-11 21:51:33 -05:00
hash.c Btrfs: fix btrfs boot when compiled as built-in 2014-01-28 13:20:31 -08:00
hash.h Btrfs: fix btrfs boot when compiled as built-in 2014-01-28 13:20:31 -08:00
inode-item.c btrfs: cleanup: removed unused 'btrfs_get_inode_ref_index' 2014-01-28 13:19:39 -08:00
inode-map.c Btrfs: fix race between caching kthread and returning inode to inode cache 2015-07-20 14:38:51 +01:00
inode-map.h Btrfs: Support reading/writing on disk free ino cache 2011-04-25 16:46:11 +08:00
inode.c Btrfs: fix cur_offset in the error case for nocow 2019-02-11 17:53:49 +00:00
ioctl.c Btrfs: fix data corruption due to cloning of eof block 2019-02-11 17:53:49 +00:00
Kconfig Btrfs: fix btrfs boot when compiled as built-in 2014-01-28 13:20:31 -08:00
locking.c btrfs: fix lockups from btrfs_clear_path_blocking 2014-12-01 10:26:06 +00:00
locking.h btrfs: fix lockups from btrfs_clear_path_blocking 2014-12-01 10:26:06 +00:00
lzo.c btrfs: zero out left over bytes after processing compression streams 2014-12-10 17:15:43 +00:00
Makefile Btrfs: add sanity tests for new qgroup accounting code 2014-06-09 17:20:49 -07:00
math.h Btrfs: cleanup duplicated division functions 2012-12-11 13:31:30 -05:00
ordered-data.c Btrfs: make sure logged extents complete in the current transaction V3 2015-01-05 13:48:52 +00:00
ordered-data.h Btrfs: make sure logged extents complete in the current transaction V3 2015-01-05 13:48:52 +00:00
orphan.c btrfs: expand btrfs_find_item() to include find_orphan_item functionality 2014-01-28 13:19:37 -08:00
print-tree.c Btrfs: fix btrfs_print_leaf for skinny metadata 2014-07-03 07:04:16 -07:00
print-tree.h btrfs: make static code static & remove dead code 2013-05-06 15:55:23 -04:00
props.c Btrfs: add support for inode properties 2014-01-28 13:20:24 -08:00
props.h Btrfs: add support for inode properties 2014-01-28 13:20:24 -08:00
qgroup.c Btrfs: fix race between enabling quotas and subvolume creation 2019-02-11 17:54:09 +00:00
qgroup.h Btrfs: rework qgroup accounting 2014-06-09 17:20:48 -07:00
raid56.c Btrfs: fix task hang under heavy compressed write 2014-09-05 16:36:37 -07:00
raid56.h Btrfs: RAID5 and RAID6 2013-02-01 14:24:23 -05:00
rcu-string.h Btrfs: use rcu to protect device->name 2012-06-14 21:29:16 -04:00
reada.c Btrfs: fix task hang under heavy compressed write 2014-09-05 16:36:37 -07:00
relocation.c btrfs: relocation: set trans to be NULL after ending transaction 2019-02-11 17:54:10 +00:00
root-tree.c Btrfs: use bitfield instead of integer data type for the some variants in btrfs_root 2014-06-09 17:20:40 -07:00
scrub.c Btrfs: fix task hang under heavy compressed write 2014-09-05 16:36:37 -07:00
send.c Btrfs: send, don't leave without decrementing clone root's send_progress 2015-06-17 15:26:38 +01:00
send.h btrfs: make static code static & remove dead code 2013-05-06 15:55:23 -04:00
struct-funcs.c Btrfs: rewrite BTRFS_SETGET_FUNCS 2012-07-23 16:28:06 -04:00
super.c Btrfs: ensure path name is null terminated at btrfs_control_ioctl 2019-02-11 17:54:04 +00:00
sysfs.c btrfs: dev add should add its sysfs entry 2014-06-28 13:48:43 -07:00
sysfs.h btrfs: dev add should add its sysfs entry 2014-06-28 13:48:43 -07:00
transaction.c Btrfs: check if previous transaction aborted to avoid fs corruption 2015-09-28 10:21:46 +01:00
transaction.h Btrfs: make sure logged extents complete in the current transaction V3 2015-01-05 13:48:52 +00:00
tree-defrag.c Btrfs: use bitfield instead of integer data type for the some variants in btrfs_root 2014-06-09 17:20:40 -07:00
tree-log.c Btrfs: bail out on error during replay_dir_deletes 2018-10-21 08:45:14 +01:00
tree-log.h Btrfs: use helpers for last_trans_log_full_commit instead of opencode 2014-06-09 17:20:45 -07:00
ulist.c Btrfs: do not export ulist functions 2014-01-29 07:06:27 -08:00
ulist.h Btrfs: Fix memory corruption by ulist_add_merge() on 32bit arch 2014-09-05 16:36:36 -07:00
uuid-tree.c Btrfs: convert printk to btrfs_ and fix BTRFS prefix 2014-01-28 13:20:05 -08:00
volumes.c btrfs: rename total_bytes to avoid confusion 2018-12-16 22:08:37 +00:00
volumes.h btrfs: check unsupported filters in balance arguments 2015-11-16 11:26:49 +00:00
xattr.c Btrfs: fix race when listing an inode's xattrs 2015-12-13 17:49:18 +00:00
xattr.h btrfs: use generic posix ACL infrastructure 2014-01-25 23:58:18 -05:00
zlib.c btrfs: zero out left over bytes after processing compression streams 2014-12-10 17:15:43 +00:00