Hi Chris, This fixes some issues relating to direct I/O submission, however a further patch will be needed to handle the case where allocation of 'dip' fails, which is always dereferenced when finding the ordered extent.
Thanks, Daniel --- Fix use-after-free, potential leak of 'dip' and double assignment. Signed-off-by: Daniel J Blueman <[email protected]> diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c index 1bff92a..302e6d0 100644 --- a/fs/btrfs/inode.c +++ b/fs/btrfs/inode.c @@ -5652,7 +5652,6 @@ static void btrfs_submit_direct(int rw, struct bio *bio, struct inode *inode, ret = -ENOMEM; goto free_ordered; } - dip->csums = NULL; if (!skip_sum) { dip->csums = kmalloc(sizeof(u32) * bio->bi_vcnt, GFP_NOFS); @@ -5660,7 +5659,8 @@ static void btrfs_submit_direct(int rw, struct bio *bio, struct inode *inode, ret = -ENOMEM; goto free_ordered; } - } + } else + dip->csums = NULL; dip->private = bio->bi_private; dip->inode = inode; @@ -5704,7 +5704,6 @@ static void btrfs_submit_direct(int rw, struct bio *bio, struct inode *inode, return; out_err: kfree(dip->csums); - kfree(dip); free_ordered: /* * If this is a write, we need to clean up the reserved space and kill @@ -5722,6 +5721,7 @@ free_ordered: btrfs_put_ordered_extent(ordered); } bio_endio(bio, ret); + kfree(dip); } static ssize_t check_direct_IO(struct btrfs_root *root, int rw, struct kiocb *iocb, -- Daniel J Blueman -- To unsubscribe from this list: send the line "unsubscribe linux-btrfs" in the body of a message to [email protected] More majordomo info at http://vger.kernel.org/majordomo-info.html
