From: Josef Bacik <jbacik@fusionio.com>
Date: Thu, 6 Jun 2013 14:29:40 +0000 (-0400)
Subject: Btrfs: don't delete fs_roots until after we cleanup the transaction
X-Git-Url: https://git.stricted.de/?a=commitdiff_plain;h=7b5ff90ed081787ec0765ceb4fe5ccf5677493a6;p=GitHub%2Fmoto-9609%2Fandroid_kernel_motorola_exynos9610.git

Btrfs: don't delete fs_roots until after we cleanup the transaction

We get a use after free if we had a transaction to cleanup since there could be
delayed inodes which refer to their respective fs_root.  Thanks

Reported-by: David Sterba <dsterba@suse.cz>
Signed-off-by: Josef Bacik <jbacik@fusionio.com>
Signed-off-by: Chris Mason <chris.mason@fusionio.com>
---

diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c
index e7b3cb5286a5..bdaa092d6296 100644
--- a/fs/btrfs/disk-io.c
+++ b/fs/btrfs/disk-io.c
@@ -2859,8 +2859,8 @@ fail_qgroup:
 	btrfs_free_qgroup_config(fs_info);
 fail_trans_kthread:
 	kthread_stop(fs_info->transaction_kthread);
-	del_fs_roots(fs_info);
 	btrfs_cleanup_transaction(fs_info->tree_root);
+	del_fs_roots(fs_info);
 fail_cleaner:
 	kthread_stop(fs_info->cleaner_kthread);