Ilya Dryomov 1357272fc7 Btrfs: fix a use-after-free bug in btrfs_dev_replace_finishing ...

free_device rcu callback, scheduled from btrfs_rm_dev_replace_srcdev,
can be processed before btrfs_scratch_superblock is called, which would
result in a use-after-free on btrfs_device contents.  Fix this by
zeroing the superblock before the rcu callback is registered.

Cc: Stefan Behrens <sbehrens@giantdisaster.de>
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Signed-off-by: Josef Bacik <jbacik@fusionio.com>

2013-10-04 16:02:14 -04:00

27 KiB

Raw Blame History

View Raw