Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mason/linux-btrfs

torvalds · torvalds · commit c4c23fb6f2b1 · 2014-11-09T14:30:24.000-08:00
Pull btrfs fix from Chris Mason:
 "It's a one liner for an error cleanup path that leads to crashes"

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mason/linux-btrfs:
  Btrfs: fix kfree on list_head in btrfs_lookup_csums_range error cleanup
diff --git a/fs/btrfs/file-item.c b/fs/btrfs/file-item.c
@@ -413,7 +413,7 @@ int btrfs_lookup_csums_range(struct btrfs_root *root, u64 start, u64 end,
 	ret = 0;
 fail:
 	while (ret < 0 && !list_empty(&tmplist)) {
-		sums = list_entry(&tmplist, struct btrfs_ordered_sum, list);
+		sums = list_entry(tmplist.next, struct btrfs_ordered_sum, list);
 		list_del(&sums->list);
 		kfree(sums);
 	}

Original file line number	Diff line number	Diff line change
`@@ -413,7 +413,7 @@ int btrfs_lookup_csums_range(struct btrfs_root *root, u64 start, u64 end,`
`413`	`413`	`ret = 0;`
`414`	`414`	`fail:`
`415`	`415`	`while (ret < 0 && !list_empty(&tmplist)) {`
`416`		`- sums = list_entry(&tmplist, struct btrfs_ordered_sum, list);`
	`416`	`+ sums = list_entry(tmplist.next, struct btrfs_ordered_sum, list);`
`417`	`417`	`list_del(&sums->list);`
`418`	`418`	`kfree(sums);`
`419`	`419`	`}`