Kernel/linux-next
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git synced 2025-01-11 08:18:47 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Btrfs: Fix use after free during compressed reads

Browse Source 
Yan's fix to use the correct file offset during compressed reads used the
extent_map struct pointer after it had been freed.  This saves the
fields we want for later use instead.

Signed-off-by: Chris Mason <chris.mason@oracle.com>
This commit is contained in:
Chris Mason 2008-11-10 11:44:58 -05:00
parent ff5b7ee33d
commit e04ca626ba
1 changed files with 6 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
fs/btrfs/compression.c
View File

@ -505,6 +505,8 @@ int btrfs_submit_compressed_read(struct inode *inode, struct bio *bio,
struct block_device *bdev; struct block_device *bdev;
struct bio *comp_bio; struct bio *comp_bio;
u64 cur_disk_byte = (u64)bio->bi_sector << 9; u64 cur_disk_byte = (u64)bio->bi_sector << 9;
u64 em_len;
u64 em_start;
struct extent_map *em; struct extent_map *em;
int ret; int ret;
@ -525,7 +527,10 @@ int btrfs_submit_compressed_read(struct inode *inode, struct bio *bio,
cb->start = em->orig_start; cb->start = em->orig_start;
compressed_len = em->block_len; compressed_len = em->block_len;
em_len = em->len;
em_start = em->start;
free_extent_map(em); free_extent_map(em);
em = NULL;
cb->len = uncompressed_len; cb->len = uncompressed_len;
cb->compressed_len = compressed_len; cb->compressed_len = compressed_len;
@ -543,7 +548,7 @@ int btrfs_submit_compressed_read(struct inode *inode, struct bio *bio,
} }
cb->nr_pages = nr_pages; cb->nr_pages = nr_pages;
add_ra_bio_pages(inode, em->start + em->len, cb); add_ra_bio_pages(inode, em_start + em_len, cb);
if (!btrfs_test_opt(root, NODATASUM) && if (!btrfs_test_opt(root, NODATASUM) &&
!btrfs_test_flag(inode, NODATASUM)) { !btrfs_test_flag(inode, NODATASUM)) {