diff options
| author | Christophe JAILLET <christophe.jaillet@wanadoo.fr> | 2023-09-13 19:44:08 +0300 |
|---|---|---|
| committer | Kent Overstreet <kent.overstreet@linux.dev> | 2023-10-23 00:10:13 +0300 |
| commit | 71933fb69b7c5fe5efd2119b645d4fde337a6f3f (patch) | |
| tree | 46f165913e66c9d88424e45e30ffe3483496dc3d /fs | |
| parent | a9737e0b38352e984fc67d5694b2c207c6b9679f (diff) | |
| download | linux-71933fb69b7c5fe5efd2119b645d4fde337a6f3f.tar.xz | |
bcachefs: Fix use-after-free in bch2_dev_add()
If __bch2_dev_attach_bdev() fails, bch2_dev_free() is called twice.
Once here and another time in the error handling path.
This leads to several use-after-free.
Remove the redundant call and only rely on the error handling path.
Fixes: 6a44735653d4 ("bcachefs: Improved superblock-related error messages")
Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Signed-off-by: Kent Overstreet <kent.overstreet@linux.dev>
Diffstat (limited to 'fs')
| -rw-r--r-- | fs/bcachefs/super.c | 4 |
1 files changed, 1 insertions, 3 deletions
diff --git a/fs/bcachefs/super.c b/fs/bcachefs/super.c index 94e296397e32..9f852a6dd76a 100644 --- a/fs/bcachefs/super.c +++ b/fs/bcachefs/super.c @@ -1613,10 +1613,8 @@ int bch2_dev_add(struct bch_fs *c, const char *path) bch2_dev_usage_init(ca); ret = __bch2_dev_attach_bdev(ca, &sb); - if (ret) { - bch2_dev_free(ca); + if (ret) goto err; - } ret = bch2_dev_journal_alloc(ca); if (ret) { |