summaryrefslogtreecommitdiff
path: root/fs/btrfs
diff options
context:
space:
mode:
authorJosef Bacik <jbacik@fusionio.com>2013-06-06 10:29:40 -0400
committerChris Mason <chris.mason@fusionio.com>2013-06-08 15:07:53 -0400
commit7b5ff90ed081787ec0765ceb4fe5ccf5677493a6 (patch)
treefd0bffca467dde8ac29405004e8bf81be0725f11 /fs/btrfs
parentc5cb6a0573bef87e098ee3cd946115ebe60a910e (diff)
downloadlinux-3.10-7b5ff90ed081787ec0765ceb4fe5ccf5677493a6.tar.gz
linux-3.10-7b5ff90ed081787ec0765ceb4fe5ccf5677493a6.tar.bz2
linux-3.10-7b5ff90ed081787ec0765ceb4fe5ccf5677493a6.zip
Btrfs: don't delete fs_roots until after we cleanup the transaction
We get a use after free if we had a transaction to cleanup since there could be delayed inodes which refer to their respective fs_root. Thanks Reported-by: David Sterba <dsterba@suse.cz> Signed-off-by: Josef Bacik <jbacik@fusionio.com> Signed-off-by: Chris Mason <chris.mason@fusionio.com>
Diffstat (limited to 'fs/btrfs')
-rw-r--r--fs/btrfs/disk-io.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c
index e7b3cb5286a..bdaa092d629 100644
--- a/fs/btrfs/disk-io.c
+++ b/fs/btrfs/disk-io.c
@@ -2859,8 +2859,8 @@ fail_qgroup:
btrfs_free_qgroup_config(fs_info);
fail_trans_kthread:
kthread_stop(fs_info->transaction_kthread);
- del_fs_roots(fs_info);
btrfs_cleanup_transaction(fs_info->tree_root);
+ del_fs_roots(fs_info);
fail_cleaner:
kthread_stop(fs_info->cleaner_kthread);