diff options
| author | Dan Carpenter | 2018-08-20 10:25:33 +0200 |
|---|---|---|
| committer | David Sterba | 2018-08-23 17:37:27 +0200 |
| commit | b9b8a41adeff5666b402996020b698504c927353 (patch) | |
| tree | aeceb9763a86ff57b52915a88c7fbcf767a700dd /usr | |
| parent | btrfs: btrfs_shrink_device should call commit transaction at the end (diff) | |
| download | kernel-qcow2-linux-b9b8a41adeff5666b402996020b698504c927353.tar.gz kernel-qcow2-linux-b9b8a41adeff5666b402996020b698504c927353.tar.xz kernel-qcow2-linux-b9b8a41adeff5666b402996020b698504c927353.zip | |
btrfs: use after free in btrfs_quota_enable
The issue here is that btrfs_commit_transaction() frees "trans" on both
the error and the success path. So the problem would be if
btrfs_commit_transaction() succeeds, and then qgroup_rescan_init()
fails. That means that "ret" is non-zero and "trans" is non-NULL and it
leads to a use after free inside the btrfs_end_transaction() macro.
Fixes: 340f1aa27f36 ("btrfs: qgroups: Move transaction management inside btrfs_quota_enable/disable")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: Nikolay Borisov <nborisov@suse.com>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Diffstat (limited to 'usr')
0 files changed, 0 insertions, 0 deletions