Unverified Commit b54f81e4 authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!14796 btrfs: fix use-after-free when COWing tree bock and tracing is enabled 

Merge Pull Request from: @ci-robot 
 
PR sync from: Yifan Qiao <qiaoyifan4@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/X4EC524CECUCVZV3AM4Z2G4DVTCLGGRE/ 
 
https://gitee.com/src-openeuler/kernel/issues/IBG2PK 
 
Link:https://gitee.com/openeuler/kernel/pulls/14796

 

Reviewed-by: default avatarZhang Peng <zhangpeng362@huawei.com>
Signed-off-by: default avatarZhang Peng <zhangpeng362@huawei.com>
parents 174bf31d b1b2c579

fs/btrfs/ctree.c

+3 −6
Original line number Diff line number Diff line
@@ -648,6 +648,8 @@ static noinline int __btrfs_cow_block(struct btrfs_trans_handle *trans, 
		btrfs_free_tree_block(trans, btrfs_root_id(root), buf,

				      parent_start, last_ref);

	}



	trace_btrfs_cow_block(root, buf, cow);

	if (unlock_orig)

		btrfs_tree_unlock(buf);

	free_extent_buffer_stale(buf);
@@ -699,7 +701,6 @@ noinline int btrfs_cow_block(struct btrfs_trans_handle *trans, 
{

	struct btrfs_fs_info *fs_info = root->fs_info;

	u64 search_start;

	int ret;



	if (unlikely(test_bit(BTRFS_ROOT_DELETING, &root->state))) {

		btrfs_abort_transaction(trans, -EUCLEAN);
@@ -740,12 +741,8 @@ noinline int btrfs_cow_block(struct btrfs_trans_handle *trans, 
	 * Also We don't care about the error, as it's handled internally.

	 */

	btrfs_qgroup_trace_subtree_after_cow(trans, root, buf);

	ret = __btrfs_cow_block(trans, root, buf, parent,

	return __btrfs_cow_block(trans, root, buf, parent,

				 parent_slot, cow_ret, search_start, 0, nest);



	trace_btrfs_cow_block(root, buf, *cow_ret);



	return ret;

}

ALLOW_ERROR_INJECTION(btrfs_cow_block, ERRNO);