Filipe David Borba Manana
2014-Jun-29 19:43 UTC
[PATCH] Btrfs: fix use-after-free when cloning a trailing file hole
The transaction handle was being used after being freed. Cc: Chris Mason <clm@fb.com> Signed-off-by: Filipe David Borba Manana <fdmanana@gmail.com> --- fs/btrfs/ioctl.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c index 02dc64b..2562dc7 100644 --- a/fs/btrfs/ioctl.c +++ b/fs/btrfs/ioctl.c @@ -3565,12 +3565,10 @@ process_slot: btrfs_end_transaction(trans, root); goto out; } - ret = clone_finish_inode_update(trans, inode, destoff + len, - destoff, olen); - if (ret) - goto out; clone_update_extent_map(inode, trans, path, NULL, last_dest_end, destoff + len - last_dest_end); + ret = clone_finish_inode_update(trans, inode, destoff + len, + destoff, olen); } out: -- 1.9.1 -- To unsubscribe from this list: send the line "unsubscribe linux-btrfs" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html