35 lines
1.2 KiB
Diff
35 lines
1.2 KiB
Diff
From: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
|
|
Date: Wed, 14 Dec 2016 12:28:52 +0100
|
|
Subject: [PATCH] btrfs: swap free() and trace point in run_ordered_work()
|
|
Origin: https://www.kernel.org/pub/linux/kernel/projects/rt/4.9/older/patches-4.9-rt1.tar.xz
|
|
|
|
The previous patch removed a trace point due to a use after free problem
|
|
with tracing enabled. While looking at the backtrace it took me a while
|
|
to find the right spot. While doing so I noticed that this trace point
|
|
could be used with two clean-up functions in run_ordered_work():
|
|
- run_one_async_free()
|
|
- async_cow_free()
|
|
|
|
Both of them free the `work' item so a later use in the tracepoint is
|
|
not possible.
|
|
This patches swaps the order so we first have the trace point and then
|
|
free the struct.
|
|
|
|
Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
|
|
---
|
|
fs/btrfs/async-thread.c | 2 +-
|
|
1 file changed, 1 insertion(+), 1 deletion(-)
|
|
|
|
--- a/fs/btrfs/async-thread.c
|
|
+++ b/fs/btrfs/async-thread.c
|
|
@@ -306,8 +306,8 @@ static void run_ordered_work(struct __bt
|
|
* because the callback could free the structure.
|
|
*/
|
|
wtag = work;
|
|
- work->ordered_free(work);
|
|
trace_btrfs_all_work_done(wq->fs_info, wtag);
|
|
+ work->ordered_free(work);
|
|
}
|
|
spin_unlock_irqrestore(lock, flags);
|
|
}
|