| commit | 1357272fc7deeebb7b3c5d1a071562edc273cdaf | [log] [tgz] |
|---|---|---|
| author | Ilya Dryomov <idryomov@gmail.com> | Wed Oct 02 20:41:01 2013 +0300 |
| committer | Josef Bacik <jbacik@fusionio.com> | Fri Oct 04 16:02:14 2013 -0400 |
| tree | 37af6be54b03e07b4fb06a2ddc4c5ac739c53032 | |
| parent | 964fb15acfcd672ac691f04879b71f07ccc21e0c [diff] |
Btrfs: fix a use-after-free bug in btrfs_dev_replace_finishing free_device rcu callback, scheduled from btrfs_rm_dev_replace_srcdev, can be processed before btrfs_scratch_superblock is called, which would result in a use-after-free on btrfs_device contents. Fix this by zeroing the superblock before the rcu callback is registered. Cc: Stefan Behrens <sbehrens@giantdisaster.de> Signed-off-by: Ilya Dryomov <idryomov@gmail.com> Signed-off-by: Josef Bacik <jbacik@fusionio.com>