From patchwork Thu Jun 11 06:23:20 2015 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Liu Bo X-Patchwork-Id: 6586191 Return-Path: X-Original-To: patchwork-linux-btrfs@patchwork.kernel.org Delivered-To: patchwork-parsemail@patchwork1.web.kernel.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.136]) by patchwork1.web.kernel.org (Postfix) with ESMTP id 38FC89F2F4 for ; Thu, 11 Jun 2015 06:23:54 +0000 (UTC) Received: from mail.kernel.org (localhost [127.0.0.1]) by mail.kernel.org (Postfix) with ESMTP id 41D032047B for ; Thu, 11 Jun 2015 06:23:53 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 095262044C for ; Thu, 11 Jun 2015 06:23:52 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751218AbbFKGXl (ORCPT ); Thu, 11 Jun 2015 02:23:41 -0400 Received: from userp1040.oracle.com ([156.151.31.81]:25253 "EHLO userp1040.oracle.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751103AbbFKGXi (ORCPT ); Thu, 11 Jun 2015 02:23:38 -0400 Received: from userv0022.oracle.com (userv0022.oracle.com [156.151.31.74]) by userp1040.oracle.com (Sentrion-MTA-4.3.2/Sentrion-MTA-4.3.2) with ESMTP id t5B6NSUn029179 (version=TLSv1 cipher=DHE-RSA-AES256-SHA bits=256 verify=OK); Thu, 11 Jun 2015 06:23:28 GMT Received: from aserv0121.oracle.com (aserv0121.oracle.com [141.146.126.235]) by userv0022.oracle.com (8.13.8/8.13.8) with ESMTP id t5B6NRRJ007196 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=FAIL); Thu, 11 Jun 2015 06:23:27 GMT Received: from abhmp0020.oracle.com (abhmp0020.oracle.com [141.146.116.26]) by aserv0121.oracle.com (8.13.8/8.13.8) with ESMTP id t5B6NRVw011726; Thu, 11 Jun 2015 06:23:27 GMT Received: from localhost.localdomain (/10.191.13.4) by default (Oracle Beehive Gateway v4.0) with ESMTP ; Wed, 10 Jun 2015 23:23:26 -0700 Date: Thu, 11 Jun 2015 14:23:20 +0800 From: Liu Bo To: Julia Lawall , Chris Mason Cc: kbuild test robot , kbuild@01.org, David Sterba , linux-btrfs@vger.kernel.org Subject: Re: [btrfs:integration-4.2 29/57] fs/btrfs/disk-io.c:2325:17-30: ERROR: reference preceded by free on line 2324 Message-ID: <20150611062319.GA9634@localhost.localdomain> Reply-To: bo.li.liu@oracle.com References: <201506110750.oOHGNTQE%fengguang.wu@intel.com> MIME-Version: 1.0 Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.5.23 (2014-03-12) X-Source-IP: userv0022.oracle.com [156.151.31.74] Sender: linux-btrfs-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-btrfs@vger.kernel.org X-Spam-Status: No, score=-6.9 required=5.0 tests=BAYES_00, RCVD_IN_DNSWL_HI, T_RP_MATCHES_RCVD, UNPARSEABLE_RELAY autolearn=unavailable version=3.3.1 X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on mail.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP On Thu, Jun 11, 2015 at 08:07:09AM +0200, Julia Lawall wrote: > This does not look correct. Please check. Oops, thanks for pointing it out. Sorry for my miss, here is the fix. (Chris, if you prefer me to fold this into the original patch, I'll do it.) Thanks, -liubo From de72ac1c6612441bd5e1a314a05c38d727e12121 Mon Sep 17 00:00:00 2001 From: Liu Bo Date: Thu, 11 Jun 2015 14:16:44 +0800 Subject: [PATCH] Btrfs: fix use-after-free in btrfs_replay_log @log_root_tree should be referenced after kfree. Signed-off-by: Liu Bo Reviewed-by: David Sterba --- fs/btrfs/disk-io.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) free_extent_buffer(log_tree_root->node); diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c index 7f83778..3e49d80 100644 --- a/fs/btrfs/disk-io.c +++ b/fs/btrfs/disk-io.c @@ -2321,8 +2321,9 @@ static int btrfs_replay_log(struct btrfs_fs_info *fs_info, fs_info->generation + 1); if (IS_ERR(log_tree_root->node)) { printk(KERN_ERR "BTRFS: failed to read log tree\n"); + ret = PTR_ERR(log_tree_root->node); kfree(log_tree_root); - return PTR_ERR(log_tree_root->node); + return ret; } else if (!extent_buffer_uptodate(log_tree_root->node)) { printk(KERN_ERR "BTRFS: failed to read log tree\n");