lkml.org 
[lkml]   [2020]   [May]   [4]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.4 08/57] btrfs: fix transaction leak in btrfs_recover_relocation
    Date
    From: Xiyu Yang <xiyuyang19@fudan.edu.cn>

    commit 1402d17dfd9657be0da8458b2079d03c2d61c86a upstream.

    btrfs_recover_relocation() invokes btrfs_join_transaction(), which joins
    a btrfs_trans_handle object into transactions and returns a reference of
    it with increased refcount to "trans".

    When btrfs_recover_relocation() returns, "trans" becomes invalid, so the
    refcount should be decreased to keep refcount balanced.

    The reference counting issue happens in one exception handling path of
    btrfs_recover_relocation(). When read_fs_root() failed, the refcnt
    increased by btrfs_join_transaction() is not decreased, causing a refcnt
    leak.

    Fix this issue by calling btrfs_end_transaction() on this error path
    when read_fs_root() failed.

    Fixes: 79787eaab461 ("btrfs: replace many BUG_ONs with proper error handling")
    CC: stable@vger.kernel.org # 4.4+
    Reviewed-by: Filipe Manana <fdmanana@suse.com>
    Signed-off-by: Xiyu Yang <xiyuyang19@fudan.edu.cn>
    Signed-off-by: Xin Tan <tanxin.ctf@gmail.com>
    Signed-off-by: David Sterba <dsterba@suse.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

    ---
    fs/btrfs/relocation.c | 1 +
    1 file changed, 1 insertion(+)

    --- a/fs/btrfs/relocation.c
    +++ b/fs/btrfs/relocation.c
    @@ -4605,6 +4605,7 @@ int btrfs_recover_relocation(struct btrf
    if (IS_ERR(fs_root)) {
    err = PTR_ERR(fs_root);
    list_add_tail(&reloc_root->root_list, &reloc_roots);
    + btrfs_end_transaction(trans);
    goto out_unset;
    }


    \
     
     \ /
      Last update: 2020-05-04 20:12    [W:4.058 / U:0.100 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site