Commit 7e662854 authored by Qinghuang Feng's avatar Qinghuang Feng Committed by Chris Mason

Btrfs: open_ctree() error handling can oops on fs_info

a bug in open_ctree:

struct btrfs_root *open_ctree(..)
{
....
	if (!extent_root || !tree_root || !fs_info ||
	    !chunk_root || !dev_root || !csum_root) {
		err = -ENOMEM;
		goto fail;
//When code flow goes to "fail", fs_info may be NULL or uninitialized.
	}
....

fail:
	btrfs_close_devices(fs_info->fs_devices);// !
	btrfs_mapping_tree_free(&fs_info->mapping_tree);// !

	kfree(extent_root);
	kfree(tree_root);
	bdi_destroy(&fs_info->bdi);// !
...
)
Signed-off-by: default avatarQinghuang Feng <qhfeng.kernel@gmail.com>
Signed-off-by: default avatarChris Mason <chris.mason@oracle.com>
parent 86288a19
...@@ -1823,13 +1823,14 @@ struct btrfs_root *open_ctree(struct super_block *sb, ...@@ -1823,13 +1823,14 @@ struct btrfs_root *open_ctree(struct super_block *sb,
fail_iput: fail_iput:
invalidate_inode_pages2(fs_info->btree_inode->i_mapping); invalidate_inode_pages2(fs_info->btree_inode->i_mapping);
iput(fs_info->btree_inode); iput(fs_info->btree_inode);
fail:
btrfs_close_devices(fs_info->fs_devices); btrfs_close_devices(fs_info->fs_devices);
btrfs_mapping_tree_free(&fs_info->mapping_tree); btrfs_mapping_tree_free(&fs_info->mapping_tree);
bdi_destroy(&fs_info->bdi);
fail:
kfree(extent_root); kfree(extent_root);
kfree(tree_root); kfree(tree_root);
bdi_destroy(&fs_info->bdi);
kfree(fs_info); kfree(fs_info);
kfree(chunk_root); kfree(chunk_root);
kfree(dev_root); kfree(dev_root);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment