Li Zefan cdc6a39525 Btrfs: avoid possible use-after-free in clear_extent_bit() ...

clear_extent_bit()
{
    next_node = rb_next(&state->rb_node);
    ...
    clear_state_bit(state);  <-- this may free next_node
    if (next_node) {
        state = rb_entry(next_node);
        ...
    }
}

clear_state_bit() calls merge_state() which may free the next node
of the passing extent_state, so clear_extent_bit() may end up
referencing freed memory.

Signed-off-by: Li Zefan <lizf@cn.fujitsu.com>

2012-04-18 19:22:18 +02:00

..

acl.c

Btrfs: fix return value of btrfs_get_acl()

2011-10-20 18:10:47 +02:00

async-thread.c

btrfs: return void in functions without error conditions

2012-03-22 01:45:34 +01:00

async-thread.h

btrfs: return void in functions without error conditions

2012-03-22 01:45:34 +01:00

backref.c

Merge git://git.jan-o-sch.net/btrfs-unstable into for-linus

2012-03-28 20:33:40 -04:00

backref.h

Btrfs: fix regression in scrub path resolving

2012-03-27 14:51:21 +02:00

btrfs_inode.h

Btrfs: add a delalloc mutex to inodes for delalloc reservations

2012-01-16 15:29:43 -05:00

check-integrity.c

Btrfs: fix compiler warnings on 32 bit systems

2012-02-24 10:39:05 -05:00

check-integrity.h

Btrfs: add optional integrity check code

2011-12-21 19:14:09 +01:00

compat.h

…

compression.c

Btrfs: check return value of bio_alloc() properly

2012-04-12 16:03:56 -04:00

compression.h

btrfs: return void in functions without error conditions

2012-03-22 01:45:34 +01:00

ctree.c

Merge branch 'error-handling' into for-linus

2012-03-28 20:31:37 -04:00

ctree.h

Merge branch 'for-chris' of git://github.com/idryomov/btrfs-unstable into for-linus

2012-03-28 20:32:46 -04:00

delayed-inode.c

btrfs: replace many BUG_ONs with proper error handling

2012-03-22 11:52:54 +01:00

delayed-inode.h

atomic: use <linux/atomic.h>

2011-07-26 16:49:47 -07:00

delayed-ref.c

btrfs: return void in functions without error conditions

2012-03-22 01:45:34 +01:00

delayed-ref.h

Btrfs: add waitqueue instead of doing busy waiting for more delayed refs

2012-01-04 16:12:48 +01:00

dir-item.c

btrfs: replace many BUG_ONs with proper error handling

2012-03-22 11:52:54 +01:00

disk-io.c

Btrfs: do not mount when we have a sectorsize unequal to PAGE_SIZE

2012-04-18 19:22:13 +02:00

disk-io.h

btrfs: enhance transaction abort infrastructure

2012-03-22 01:45:40 +01:00

export.c

btrfs: replace many BUG_ONs with proper error handling

2012-03-22 11:52:54 +01:00

export.h

…

extent_io.c

Btrfs: avoid possible use-after-free in clear_extent_bit()

2012-04-18 19:22:18 +02:00

extent_io.h

Merge branch 'error-handling' into for-linus

2012-03-28 20:31:37 -04:00

extent_map.c

Btrfs: clean up code for merging extent maps

2011-08-01 14:30:50 -04:00

extent_map.h

btrfs: fix structs where bitfields and spinlock/atomic share 8B word

2012-02-15 16:40:25 +01:00

extent-tree.c

Btrfs: use commit root when loading free space cache

2012-04-12 20:54:01 -04:00

file-item.c

Btrfs: don't use crc items bigger than 4KB

2012-03-28 20:34:10 -04:00

file.c

btrfs: replace many BUG_ONs with proper error handling

2012-03-22 11:52:54 +01:00

free-space-cache.c

Btrfs: use commit root when loading free space cache

2012-04-12 20:54:01 -04:00

free-space-cache.h

…

hash.h

…

inode-item.c

Merge branch 'error-handling' into for-linus

2012-03-28 20:31:37 -04:00

inode-map.c

Btrfs: show useful info in space reservation tracepoint

2012-03-29 09:57:44 -04:00

inode-map.h

…

inode.c

btrfs: fix race in reada

2012-04-18 19:12:44 +02:00

ioctl.c

Btrfs: update to the right index of defragment

2012-03-29 09:57:45 -04:00

ioctl.h

Btrfs: add balance progress reporting

2012-01-16 22:04:49 +02:00

Kconfig

Btrfs: add config option to enable btrfs integrity check

2011-12-21 19:14:16 +01:00

locking.c

btrfs: return void in functions without error conditions

2012-03-22 01:45:34 +01:00

locking.h

btrfs: return void in functions without error conditions

2012-03-22 01:45:34 +01:00

lzo.c

…

Makefile

Merge branch 'integrity-check-patch-v2' of git://btrfs.giantdisaster.de/git/btrfs into integration

2012-01-16 15:27:58 -05:00

ordered-data.c

btrfs: return void in functions without error conditions

2012-03-22 01:45:34 +01:00

ordered-data.h

btrfs: return void in functions without error conditions

2012-03-22 01:45:34 +01:00

orphan.c

btrfs: replace many BUG_ONs with proper error handling

2012-03-22 11:52:54 +01:00

print-tree.c

btrfs: fix oops on failure path

2011-10-20 18:10:50 +02:00

print-tree.h

…

reada.c

btrfs: don't add both copies of DUP to reada extent tree

2012-04-18 19:12:44 +02:00

relocation.c

btrfs: replace many BUG_ONs with proper error handling

2012-03-22 11:52:54 +01:00

root-tree.c

btrfs: replace many BUG_ONs with proper error handling

2012-03-22 11:52:54 +01:00

scrub.c

Btrfs: check return value of bio_alloc() properly

2012-04-12 16:03:56 -04:00

struct-funcs.c

Btrfs: add the ability to cache a pointer into the eb

2012-03-26 17:04:23 -04:00

super.c

Merge git://git.jan-o-sch.net/btrfs-unstable into for-linus

2012-03-28 20:33:40 -04:00

sysfs.c

btrfs: Remove unused sysfs code

2011-06-17 14:54:18 -04:00

transaction.c

btrfs: add missing unlocks to transaction abort paths

2012-04-18 19:22:14 +02:00

transaction.h

btrfs: enhance transaction abort infrastructure

2012-03-22 01:45:40 +01:00

tree-defrag.c

…

tree-log.c

btrfs: replace many BUG_ONs with proper error handling

2012-03-22 11:52:54 +01:00

tree-log.h

btrfs: return void in functions without error conditions

2012-03-22 01:45:34 +01:00

ulist.c

Btrfs: generic data structure to build unique lists

2011-12-22 16:22:24 +01:00

ulist.h

Btrfs: generic data structure to build unique lists

2011-12-22 16:22:24 +01:00

version.h

…

volumes.c

Btrfs: fix eof while discarding extents

2012-04-12 16:03:56 -04:00

volumes.h

btrfs: return void in functions without error conditions

2012-03-22 01:45:34 +01:00

xattr.c

Btrfs: do not use btrfs_end_transaction_throttle everywhere

2012-01-16 15:28:54 -05:00

xattr.h

…

zlib.c

…