Commit 2037a093 authored by Sasha Levin's avatar Sasha Levin Committed by Chris Mason

btrfs: use after free when closing devices

__btrfs_close_devices() would call_rcu to free the device, which is racy with
list_for_each_entry() accessing the memory to retrieve the next device on the
list.
Signed-off-by: default avatarSasha Levin <sasha.levin@oracle.com>
Reviewed-by: default avatarDavid Sterba <dsterba@suse.cz>
Signed-off-by: default avatarChris Mason <clm@fb.com>
parent 01b810b8
...@@ -693,13 +693,13 @@ static void free_device(struct rcu_head *head) ...@@ -693,13 +693,13 @@ static void free_device(struct rcu_head *head)
static int __btrfs_close_devices(struct btrfs_fs_devices *fs_devices) static int __btrfs_close_devices(struct btrfs_fs_devices *fs_devices)
{ {
struct btrfs_device *device; struct btrfs_device *device, *tmp;
if (--fs_devices->opened > 0) if (--fs_devices->opened > 0)
return 0; return 0;
mutex_lock(&fs_devices->device_list_mutex); mutex_lock(&fs_devices->device_list_mutex);
list_for_each_entry(device, &fs_devices->devices, dev_list) { list_for_each_entry_safe(device, tmp, &fs_devices->devices, dev_list) {
struct btrfs_device *new_device; struct btrfs_device *new_device;
struct rcu_string *name; struct rcu_string *name;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment