Commit 7b5ff90e authored by Josef Bacik's avatar Josef Bacik Committed by Chris Mason

Btrfs: don't delete fs_roots until after we cleanup the transaction

We get a use after free if we had a transaction to cleanup since there could be
delayed inodes which refer to their respective fs_root.  Thanks
Reported-by: default avatarDavid Sterba <dsterba@suse.cz>
Signed-off-by: default avatarJosef Bacik <jbacik@fusionio.com>
Signed-off-by: default avatarChris Mason <chris.mason@fusionio.com>
parent c5cb6a05
...@@ -2859,8 +2859,8 @@ int open_ctree(struct super_block *sb, ...@@ -2859,8 +2859,8 @@ int open_ctree(struct super_block *sb,
btrfs_free_qgroup_config(fs_info); btrfs_free_qgroup_config(fs_info);
fail_trans_kthread: fail_trans_kthread:
kthread_stop(fs_info->transaction_kthread); kthread_stop(fs_info->transaction_kthread);
del_fs_roots(fs_info);
btrfs_cleanup_transaction(fs_info->tree_root); btrfs_cleanup_transaction(fs_info->tree_root);
del_fs_roots(fs_info);
fail_cleaner: fail_cleaner:
kthread_stop(fs_info->cleaner_kthread); kthread_stop(fs_info->cleaner_kthread);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment