Commit 3065ae5b authored by David Sterba's avatar David Sterba
Browse files

btrfs: add missing device::flush_bio puts 



This fixes potential bio leaks, in several error paths. Unfortunatelly
the device structure freeing is opencoded in many places and I missed
them when introducing the flush_bio.

Most of the time, devices get freed through call_rcu(..., free_device),
so it at least it's not that easy to hit the leak, but it's still
possible through the path that frees stale devices.

Fixes: e0ae9994 ("btrfs: preallocate device flush bio")
Reviewed-by: default avatarNikolay Borisov <nborisov@suse.com>
Reviewed-by: default avatarAnand Jain <anand.jain@oracle.com>
Signed-off-by: default avatarDavid Sterba <dsterba@suse.com>
parent 5e9f2ad5

fs/btrfs/volumes.c

+10 −0
Original line number Diff line number Diff line
@@ -189,6 +189,7 @@ static void free_fs_devices(struct btrfs_fs_devices *fs_devices) 
				    struct btrfs_device, dev_list);

		list_del(&device->dev_list);

		rcu_string_free(device->name);

		bio_put(device->flush_bio);

		kfree(device);

	}

	kfree(fs_devices);
@@ -578,6 +579,7 @@ static void btrfs_free_stale_device(struct btrfs_device *cur_dev) 
				fs_devs->num_devices--;

				list_del(&dev->dev_list);

				rcu_string_free(dev->name);

				bio_put(dev->flush_bio);

				kfree(dev);

			}

			break;
@@ -630,6 +632,7 @@ static noinline int device_list_add(const char *path, 


		name = rcu_string_strdup(path, GFP_NOFS);

		if (!name) {

			bio_put(device->flush_bio);

			kfree(device);

			return -ENOMEM;

		}
@@ -742,6 +745,7 @@ static struct btrfs_fs_devices *clone_fs_devices(struct btrfs_fs_devices *orig) 
			name = rcu_string_strdup(orig_dev->name->str,

					GFP_KERNEL);

			if (!name) {

				bio_put(device->flush_bio);

				kfree(device);

				goto error;

			}
@@ -807,6 +811,7 @@ again: 
		list_del_init(&device->dev_list);

		fs_devices->num_devices--;

		rcu_string_free(device->name);

		bio_put(device->flush_bio);

		kfree(device);

	}
@@ -2353,6 +2358,7 @@ int btrfs_init_new_device(struct btrfs_fs_info *fs_info, const char *device_path 


	name = rcu_string_strdup(device_path, GFP_KERNEL);

	if (!name) {

		bio_put(device->flush_bio);

		kfree(device);

		ret = -ENOMEM;

		goto error;
@@ -2362,6 +2368,7 @@ int btrfs_init_new_device(struct btrfs_fs_info *fs_info, const char *device_path 
	trans = btrfs_start_transaction(root, 0);

	if (IS_ERR(trans)) {

		rcu_string_free(device->name);

		bio_put(device->flush_bio);

		kfree(device);

		ret = PTR_ERR(trans);

		goto error;
@@ -2505,6 +2512,7 @@ error_trans: 
	if (trans)

		btrfs_end_transaction(trans);

	rcu_string_free(device->name);

	bio_put(device->flush_bio);

	kfree(device);

error:

	blkdev_put(bdev, FMODE_EXCL);
@@ -2571,6 +2579,7 @@ int btrfs_init_dev_replace_tgtdev(struct btrfs_fs_info *fs_info, 


	name = rcu_string_strdup(device_path, GFP_KERNEL);

	if (!name) {

		bio_put(device->flush_bio);

		kfree(device);

		ret = -ENOMEM;

		goto error;
@@ -6288,6 +6297,7 @@ struct btrfs_device *btrfs_alloc_device(struct btrfs_fs_info *fs_info, 


		ret = find_next_devid(fs_info, &tmp);

		if (ret) {

			bio_put(dev->flush_bio);

			kfree(dev);

			return ERR_PTR(ret);

		}

CRA Git | Maintained and supported by SUSTech CRA and CCSE