Commit 6e5aafb2 authored by Chris Mason's avatar Chris Mason

Btrfs: fix kfree on list_head in btrfs_lookup_csums_range error cleanup

If we hit any errors in btrfs_lookup_csums_range, we'll loop through all
the csums we allocate and free them.  But the code was using list_entry
incorrectly, and ended up trying to free the on-stack list_head instead.

This bug came from commit 0678b618

btrfs: Don't BUG_ON kzalloc error in btrfs_lookup_csums_range()
Signed-off-by: default avatarChris Mason <clm@fb.com>
Reported-by: default avatarErik Berg <btrfs@slipsprogrammoer.no>
cc: stable@vger.kernel.org # 3.3 or newer
parent d05a2b4c
...@@ -413,7 +413,7 @@ int btrfs_lookup_csums_range(struct btrfs_root *root, u64 start, u64 end, ...@@ -413,7 +413,7 @@ int btrfs_lookup_csums_range(struct btrfs_root *root, u64 start, u64 end,
ret = 0; ret = 0;
fail: fail:
while (ret < 0 && !list_empty(&tmplist)) { while (ret < 0 && !list_empty(&tmplist)) {
sums = list_entry(&tmplist, struct btrfs_ordered_sum, list); sums = list_entry(tmplist.next, struct btrfs_ordered_sum, list);
list_del(&sums->list); list_del(&sums->list);
kfree(sums); kfree(sums);
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment