btrfs: drop the lock on error in btrfs_dev_replace_cancel

Dan Carpenter · kdave · commit 669e859b5ea7 · 2019-02-25T14:13:41.000+01:00
We should drop the lock on this error path. This has been found by a static tool. The lock needs to be released, it's there to protect access to the dev_replace members and is not supposed to be left locked. The value of state that's being switched would need to be artifically changed to an invalid value so the default: branch is taken. Fixes: d189dd7 ("btrfs: fix use-after-free due to race between replace start and cancel") CC: stable@vger.kernel.org # 5.0+ Reviewed-by: Anand Jain <anand.jain@oracle.com> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Reviewed-by: David Sterba <dsterba@suse.com> Signed-off-by: David Sterba <dsterba@suse.com>
diff --git a/fs/btrfs/dev-replace.c b/fs/btrfs/dev-replace.c
@@ -862,6 +862,7 @@ int btrfs_dev_replace_cancel(struct btrfs_fs_info *fs_info)
 			btrfs_destroy_dev_replace_tgtdev(tgt_device);
 		break;
 	default:
+		up_write(&dev_replace->rwsem);
 		result = -EINVAL;
 	}
 

Original file line number	Diff line number	Diff line change
`@@ -862,6 +862,7 @@ int btrfs_dev_replace_cancel(struct btrfs_fs_info *fs_info)`
`862`	`862`	`btrfs_destroy_dev_replace_tgtdev(tgt_device);`
`863`	`863`	`break;`
`864`	`864`	`default:`
	`865`	`+ up_write(&dev_replace->rwsem);`
`865`	`866`	`result = -EINVAL;`
`866`	`867`	`}`
`867`	`868`