Nikolay Borisov e1994e4d56 btrfs: Fix use-after-free when cleaning up fs_devs with a single stale device ... commit fd649f10c3d21ee9d7542c609f29978bdf73ab94 upstream. Commit 4fde46f0cc ("Btrfs: free the stale device") introduced btrfs_free_stale_device which iterates the device lists for all registered btrfs filesystems and deletes those devices which aren't mounted. In a btrfs_devices structure has only 1 device attached to it and it is unused then btrfs_free_stale_devices will proceed to also free the btrfs_fs_devices struct itself. Currently this leads to a use after free since list_for_each_entry will try to perform a check on the already freed memory to see if it has to terminate the loop. The fix is to use 'break' when we know we are freeing the current fs_devs. Fixes: 4fde46f0cc ("Btrfs: free the stale device") Signed-off-by: Nikolay Borisov <nborisov@suse.com> Reviewed-by: Anand Jain <anand.jain@oracle.com> Signed-off-by: David Sterba <dsterba@suse.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2018-03-22 09:23:32 +01:00
..
tests	Btrfs: tests: checking for NULL instead of IS_ERR()	2015-11-25 05:19:50 -08:00
acl.c	btrfs: preserve i_mode if __btrfs_set_acl() fails	2018-03-11 16:19:47 +01:00
async-thread.c	btrfs: limit async_work allocation and worker func duration	2017-01-06 11:16:06 +01:00
async-thread.h	btrfs: limit async_work allocation and worker func duration	2017-01-06 11:16:06 +01:00
backref.c	Btrfs: fix hang on extent buffer lock caused by the inode_paths ioctl	2016-02-25 12:01:15 -08:00
backref.h	btrfs: cleanup, remove inode_item_info helper	2015-01-14 19:23:47 +01:00
btrfs_inode.h	Btrfs: Direct I/O: Fix space accounting	2015-09-21 13:47:55 -07:00
check-integrity.c	Merge branch 'cleanups/for-4.4' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux into for-linus-4.4	2015-10-21 18:21:40 -07:00
check-integrity.h
compression.c	btrfs: assign error values to the correct bio structs	2016-10-22 12:26:54 +02:00
compression.h	btrfs: constify structs with op functions or static definitions	2015-02-16 18:48:44 +01:00
ctree.c	btrfs: account for non-CoW'd blocks in btrfs_abort_transaction	2016-07-27 09:47:33 -07:00
ctree.h	btrfs: store and load values of stripes_min/stripes_max in balance status item	2017-01-06 11:16:06 +01:00
delayed-inode.c	btrfs: limit async_work allocation and worker func duration	2017-01-06 11:16:06 +01:00
delayed-inode.h	btrfs: properly set the termination value of ctx->pos in readdir	2016-02-25 12:01:15 -08:00
delayed-ref.c	btrfs: qgroup: Fix a race in delayed_ref which leads to abort trans	2015-10-26 19:44:39 -07:00
delayed-ref.h	btrfs: qgroup: Fix a race in delayed_ref which leads to abort trans	2015-10-26 19:44:39 -07:00
dev-replace.c	Merge branch 'fix/waitqueue-barriers' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux into for-linus-4.4	2015-10-12 16:24:40 -07:00
dev-replace.h
dir-item.c	Btrfs: make xattr replace operations atomic	2014-11-20 17:20:07 -08:00
disk-io.c	btrfs: properly track when rescan worker is running	2016-09-07 08:32:43 +02:00
disk-io.h	Btrfs: add btrfs_read_dev_one_super() to read one specific SB	2015-10-01 17:29:38 +02:00
export.c	BTRFS: support NFSv2 export	2015-10-06 06:55:23 -07:00
export.h
extent-tree.c	btrfs: clear space cache inode generation always	2017-12-05 11:22:50 +01:00
extent-tree.h	btrfs: qgroup: Add new qgroup calculation function	2015-06-10 09:25:49 -07:00
extent_io.c	Btrfs: fix memory leak in reading btree blocks	2017-01-06 11:16:10 +01:00
extent_io.h	btrfs: qgroup: Introduce btrfs_qgroup_reserve_data function	2015-10-21 18:37:45 -07:00
extent_map.c	Btrfs: do not move em to modified list when unpinning	2014-11-21 11:59:54 -08:00
extent_map.h	Btrfs: fix NULL pointer crash when running balance and scrub concurrently	2014-06-19 14:20:55 -07:00
file-item.c	Merge branch 'cleanups-post-3.19' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux into for-linus-4.1	2015-03-25 10:52:48 -07:00
file.c	fs: add i_blocksize()	2017-06-14 13:16:24 +02:00
free-space-cache.c	btrfs: fix deadlock when writing out space cache	2018-02-03 17:04:27 +01:00
free-space-cache.h	Btrfs: keep track of largest extent in bitmaps	2015-10-21 18:55:40 -07:00
hash.c	btrfs: LLVMLinux: Remove VLAIS	2014-10-14 10:51:22 +02:00
hash.h	Btrfs: fix btrfs boot when compiled as built-in	2014-01-28 13:20:31 -08:00
inode-item.c	Btrfs: consolidate btrfs_error() to btrfs_std_error()	2015-09-29 16:30:00 +02:00
inode-map.c	Btrfs: Initialize btrfs_root->highest_objectid when loading tree root and subvolume roots	2016-03-03 15:07:12 -08:00
inode-map.h	Btrfs: Initialize btrfs_root->highest_objectid when loading tree root and subvolume roots	2016-03-03 15:07:12 -08:00
inode.c	Btrfs: fix deadlock in run_delalloc_nocow	2018-02-22 15:45:00 +01:00
ioctl.c	btrfs: Fix possible off-by-one in btrfs_search_path_in_tree	2018-02-25 11:03:40 +01:00
Kconfig	rcu: Make SRCU optional by using CONFIG_SRCU	2015-01-06 11:04:29 -08:00
locking.c	btrfs: comment the rest of implicit barriers before waitqueue_active	2015-10-10 18:42:00 +02:00
locking.h	btrfs: fix lockups from btrfs_clear_path_blocking	2014-11-19 10:34:35 -08:00
lzo.c	btrfs: constify structs with op functions or static definitions	2015-02-16 18:48:44 +01:00
Makefile	Btrfs: add sanity tests for new qgroup accounting code	2014-06-09 17:20:49 -07:00
math.h	btrfs: cleanup 64bit/32bit divs, compile time constants	2015-03-03 17:23:57 +01:00
ordered-data.c	Btrfs: change how we wait for pending ordered extents	2015-10-21 18:51:40 -07:00
ordered-data.h	Btrfs: change how we wait for pending ordered extents	2015-10-21 18:51:40 -07:00
orphan.c	btrfs: kill the key type accessor helpers	2014-09-17 13:37:12 -07:00
print-tree.c	btrfs: remove parameter blocksize from read_tree_block	2014-10-02 17:14:50 +02:00
print-tree.h
props.c	btrfs: cleanup iterating over prop_handlers array	2015-10-21 18:28:48 +02:00
props.h	Btrfs: add support for inode properties	2014-01-28 13:20:24 -08:00
qgroup.c	Btrfs: fix qgroup rescan worker initialization	2017-01-06 11:16:06 +01:00
qgroup.h	btrfs: waiting on qgroup rescan should not always be interruptible	2016-09-07 08:32:43 +02:00
raid56.c	btrfs: comment waitqueue_active implied by locks	2015-10-10 18:35:10 +02:00
raid56.h	Btrfs: add RAID 5/6 BTRFS_RBIO_REBUILD_MISSING operation	2015-08-09 07:34:26 -07:00
rcu-string.h
reada.c	btrfs: reada: Fix returned errno code	2015-10-21 18:29:50 +02:00
relocation.c	btrfs: fix NULL pointer dereference from free_reloc_roots()	2017-10-05 09:41:46 +02:00
root-tree.c	Btrfs: fix loading of orphan roots leading to BUG_ON	2016-03-09 15:34:53 -08:00
scrub.c	Btrfs: fix scrub preventing unused block groups from being deleted	2015-11-25 05:22:08 -08:00
send.c	Btrfs: send, fix failure to rename top level inode due to name collision	2017-10-21 17:09:04 +02:00
send.h
struct-funcs.c
super.c	btrfs: resume qgroup rescan on rw remount	2017-09-13 14:09:46 -07:00
sysfs.c	Btrfs: rename super_kobj to fsid_kobj	2015-09-29 16:29:59 +02:00
sysfs.h	Btrfs: rename btrfs_kobj_rm_device to btrfs_sysfs_rm_device_link	2015-09-29 16:29:59 +02:00
transaction.c	Btrfs: fix unprotected list move from unused_bgs to deleted_bgs list	2015-12-10 11:22:38 +00:00
transaction.h	btrfs: account for non-CoW'd blocks in btrfs_abort_transaction	2016-07-27 09:47:33 -07:00
tree-defrag.c	Btrfs: cleanup: remove unnecessary check before btrfs_free_path is called	2015-08-31 11:46:41 -07:00
tree-log.c	Btrfs: fix unexpected -EEXIST when creating new inode	2018-02-22 15:45:00 +01:00
tree-log.h	Btrfs: fix metadata inconsistencies after directory fsync	2015-03-26 17:56:23 -07:00
ulist.c	btrfs: ulist: Add ulist_del() function.	2015-06-10 09:26:17 -07:00
ulist.h	btrfs: ulist: Add ulist_del() function.	2015-06-10 09:26:17 -07:00
uuid-tree.c	btrfs: return the actual error value from from btrfs_uuid_tree_iterate	2017-11-30 08:37:28 +00:00
volumes.c	btrfs: Fix use-after-free when cleaning up fs_devs with a single stale device	2018-03-22 09:23:32 +01:00
volumes.h	btrfs: fix clashing number of the enhanced balance usage filter	2015-11-25 05:19:50 -08:00
xattr.c	Btrfs: fix race when listing an inode's xattrs	2015-11-09 18:34:40 +00:00
xattr.h
zlib.c	btrfs: constify structs with op functions or static definitions	2015-02-16 18:48:44 +01:00