提交 eb1716af 编写于 作者: J Jan Schmidt 提交者: Josef Bacik

Btrfs: avoid double free of fs_info->qgroup_ulist

When btrfs_read_qgroup_config or btrfs_quota_enable return non-zero, we've
already freed the fs_info->qgroup_ulist. The final btrfs_free_qgroup_config
called from quota_disable makes another ulist_free(fs_info->qgroup_ulist)
call.

We set fs_info->qgroup_ulist to NULL on the mentioned error paths, turning
the ulist_free in btrfs_free_qgroup_config into a noop.

Cc: Wang Shilong <wangsl-fnst@cn.fujitsu.com>
Signed-off-by: NJan Schmidt <list.btrfs@jan-o-sch.net>
Signed-off-by: NJosef Bacik <jbacik@fusionio.com>
上级 4373519d
......@@ -430,8 +430,10 @@ int btrfs_read_qgroup_config(struct btrfs_fs_info *fs_info)
}
btrfs_free_path(path);
if (ret < 0)
if (ret < 0) {
ulist_free(fs_info->qgroup_ulist);
fs_info->qgroup_ulist = NULL;
}
return ret < 0 ? ret : 0;
}
......@@ -932,8 +934,10 @@ int btrfs_quota_enable(struct btrfs_trans_handle *trans,
kfree(quota_root);
}
out:
if (ret)
if (ret) {
ulist_free(fs_info->qgroup_ulist);
fs_info->qgroup_ulist = NULL;
}
mutex_unlock(&fs_info->qgroup_ioctl_lock);
return ret;
}
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册