lkml.org 
[lkml]   [2017]   [Jan]   [10]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.9 201/206] xfs: fix double-cleanup when CUI recovery fails
    Date
    4.9-stable review patch.  If anyone has any objections, please let me know.

    ------------------


    From: "Darrick J. Wong" <darrick.wong@oracle.com>

    commit 7a21272b088894070391a94fdd1c67014020fa1d upstream.

    Dan Carpenter reported a double-free of rcur if _defer_finish fails
    while we're recovering CUI items. Fix the error recovery to prevent
    this.

    Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
    Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
    Cc: Christoph Hellwig <hch@lst.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    ---
    fs/xfs/xfs_refcount_item.c | 3 ++-
    1 file changed, 2 insertions(+), 1 deletion(-)

    --- a/fs/xfs/xfs_refcount_item.c
    +++ b/fs/xfs/xfs_refcount_item.c
    @@ -526,13 +526,14 @@ xfs_cui_recover(
    xfs_refcount_finish_one_cleanup(tp, rcur, error);
    error = xfs_defer_finish(&tp, &dfops, NULL);
    if (error)
    - goto abort_error;
    + goto abort_defer;
    set_bit(XFS_CUI_RECOVERED, &cuip->cui_flags);
    error = xfs_trans_commit(tp);
    return error;

    abort_error:
    xfs_refcount_finish_one_cleanup(tp, rcur, error);
    +abort_defer:
    xfs_defer_cancel(&dfops);
    xfs_trans_cancel(tp);
    return error;

    \
     
     \ /
      Last update: 2017-01-10 14:56    [W:4.163 / U:0.100 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site