btrfs/raid56: fix and cleanup some error paths (3dc0e818) · Commits · 戴 / test

The alloc_rbio() frees "raid_map" and "bbio" on error, so there is a potential double free bug in raid56_parity_write(). The raid56_parity_write() and raid56_parity_recover() functions should still free "raid_map" and "bbio" on error if other errors occur though, so I have added some more calls to kfree(). Signed-off-by:

Dan Carpenter <dan.carpenter@oracle.com> Reviewed-by:

Miao Xie <miaox@cn.fujitsu.com> Signed-off-by:

Josef Bacik <jbacik@fusionio.com> Signed-off-by:

Chris Mason <chris.mason@fusionio.com>

fs/btrfs/raid56.c

+4 −6

Original line number	Diff line number	Diff line
		@@ -1687,11 +1687,8 @@ int raid56_parity_write(struct btrfs_root root, struct bio bio,
		struct blk_plug_cb *cb;

		rbio = alloc_rbio(root, bbio, raid_map, stripe_len);
		if (IS_ERR(rbio)) {
		kfree(raid_map);
		kfree(bbio);
		if (IS_ERR(rbio))
		return PTR_ERR(rbio);
		}
		bio_list_add(&rbio->bio_list, bio);
		rbio->bio_list_bytes = bio->bi_size;

		@@ -2041,9 +2038,8 @@ int raid56_parity_recover(struct btrfs_root root, struct bio bio,
		int ret;

		rbio = alloc_rbio(root, bbio, raid_map, stripe_len);
		if (IS_ERR(rbio)) {
		if (IS_ERR(rbio))
		return PTR_ERR(rbio);
		}

		rbio->read_rebuild = 1;
		bio_list_add(&rbio->bio_list, bio);
		@@ -2052,6 +2048,8 @@ int raid56_parity_recover(struct btrfs_root root, struct bio bio,
		rbio->faila = find_logical_bio_stripe(rbio, bio);
		if (rbio->faila == -1) {
		BUG();
		kfree(raid_map);
		kfree(bbio);
		kfree(rbio);
		return -EIO;
		}

Admin message