btrfs: use after free when closing devices
authorSasha Levin <sasha.levin@oracle.com>
Tue, 12 May 2015 23:31:37 +0000 (19:31 -0400)
committerChris Mason <clm@fb.com>
Wed, 3 Jun 2015 02:34:36 +0000 (19:34 -0700)
commit2037a0933bc2894a2f50ae57a1ccf6be192adb76
tree717aee3ea647947a67f0b9afa83ccb161398eb30
parent01b810b889d557257580970e1a7ba9c85b54766b
btrfs: use after free when closing devices

__btrfs_close_devices() would call_rcu to free the device, which is racy with
list_for_each_entry() accessing the memory to retrieve the next device on the
list.

Signed-off-by: Sasha Levin <sasha.levin@oracle.com>
Reviewed-by: David Sterba <dsterba@suse.cz>
Signed-off-by: Chris Mason <clm@fb.com>
fs/btrfs/volumes.c