Skip to content

Commit ab4c54c

Browse files
adam900710kdave
authored andcommitted
btrfs: raid56: avoid double freeing for rbio if full_stripe_write() failed
Currently if full_stripe_write() failed to allocate the pages for parity, it will call __free_raid_bio() first, then return -ENOMEM. But some caller of full_stripe_write() will also call __free_raid_bio() again, this would cause double freeing. And it's not a logically sound either, normally we should either free the memory at the same level where we allocated it, or let endio to handle everything. So this patch will solve the double freeing by make raid56_parity_write() to handle the error and free the rbio. Just like what we do in raid56_parity_recover(). Signed-off-by: Qu Wenruo <[email protected]> Signed-off-by: David Sterba <[email protected]>
1 parent f15fb2c commit ab4c54c

File tree

1 file changed

+7
-5
lines changed

1 file changed

+7
-5
lines changed

fs/btrfs/raid56.c

+7-5
Original file line numberDiff line numberDiff line change
@@ -1632,10 +1632,8 @@ static int full_stripe_write(struct btrfs_raid_bio *rbio)
16321632
int ret;
16331633

16341634
ret = alloc_rbio_parity_pages(rbio);
1635-
if (ret) {
1636-
__free_raid_bio(rbio);
1635+
if (ret)
16371636
return ret;
1638-
}
16391637

16401638
ret = lock_stripe_add(rbio);
16411639
if (ret == 0)
@@ -1823,8 +1821,10 @@ void raid56_parity_write(struct bio *bio, struct btrfs_io_context *bioc)
18231821
*/
18241822
if (rbio_is_full(rbio)) {
18251823
ret = full_stripe_write(rbio);
1826-
if (ret)
1824+
if (ret) {
1825+
__free_raid_bio(rbio);
18271826
goto fail;
1827+
}
18281828
return;
18291829
}
18301830

@@ -1838,8 +1838,10 @@ void raid56_parity_write(struct bio *bio, struct btrfs_io_context *bioc)
18381838
list_add_tail(&rbio->plug_list, &plug->rbio_list);
18391839
} else {
18401840
ret = __raid56_parity_write(rbio);
1841-
if (ret)
1841+
if (ret) {
1842+
__free_raid_bio(rbio);
18421843
goto fail;
1844+
}
18431845
}
18441846

18451847
return;

0 commit comments

Comments
 (0)