Btrfs: fix use after free in btrfs_start_workers fail path
authorJiri Slaby <jirislaby@gmail.com>
Thu, 2 Jul 2009 17:50:58 +0000 (13:50 -0400)
committerChris Mason <chris.mason@oracle.com>
Thu, 2 Jul 2009 17:50:58 +0000 (13:50 -0400)
worker memory is already freed on one fail path in btrfs_start_workers,
but is still dereferenced. Switch the dereference and kfree.

Signed-off-by: Jiri Slaby <jirislaby@gmail.com>
Signed-off-by: Chris Mason <chris.mason@oracle.com>
fs/btrfs/async-thread.c

index 7f88628a1a72e3808c6f96d47bc0ba9e363ade4c..6e4f6c50a120dfcb78eb5f26dc4301936589cd0f 100644 (file)
@@ -299,8 +299,8 @@ int btrfs_start_workers(struct btrfs_workers *workers, int num_workers)
                                           "btrfs-%s-%d", workers->name,
                                           workers->num_workers + i);
                if (IS_ERR(worker->task)) {
-                       kfree(worker);
                        ret = PTR_ERR(worker->task);
+                       kfree(worker);
                        goto fail;
                }