Commit d54a8390 authored by David Woodhouse's avatar David Woodhouse Committed by Chris Mason

Clean up btrfs_get_parent() a little more, fix a free-after-free bug

Date: Tue, 19 Aug 2008 22:33:04 +0100
Signed-off-by: default avatarDavid Woodhouse <David.Woodhouse@intel.com>
Signed-off-by: default avatarChris Mason <chris.mason@oracle.com>
parent 2d4d9fbd
...@@ -165,23 +165,32 @@ static struct dentry *btrfs_get_parent(struct dentry *child) ...@@ -165,23 +165,32 @@ static struct dentry *btrfs_get_parent(struct dentry *child)
key.offset = (u64)-1; key.offset = (u64)-1;
ret = btrfs_search_slot(NULL, root, &key, path, 0, 0); ret = btrfs_search_slot(NULL, root, &key, path, 0, 0);
if (ret < 0) {
/* Error */
btrfs_free_path(path);
return ERR_PTR(ret);
}
leaf = path->nodes[0]; leaf = path->nodes[0];
slot = path->slots[0]; slot = path->slots[0];
if (ret < 0 || slot == 0) { if (ret) {
btrfs_free_path(path); /* btrfs_search_slot() returns the slot where we'd want to
goto out; insert a backref for parent inode #0xFFFFFFFFFFFFFFFF.
The _real_ backref, telling us what the parent inode
_actually_ is, will be in the slot _before_ the one
that btrfs_search_slot() returns. */
if (!slot) {
/* Unless there is _no_ key in the tree before... */
btrfs_free_path(path);
return ERR_PTR(-EIO);
}
slot--;
} }
/* btrfs_search_slot() returns the slot where we'd want to insert
an INODE_REF_KEY for parent inode #0xFFFFFFFFFFFFFFFF. The _real_
one, telling us what the parent inode _actually_ is, will be in
the slot _before_ the one that btrfs_search_slot() returns. */
slot--;
btrfs_item_key_to_cpu(leaf, &key, slot); btrfs_item_key_to_cpu(leaf, &key, slot);
btrfs_free_path(path); btrfs_free_path(path);
if (key.objectid != dir->i_ino || key.type != BTRFS_INODE_REF_KEY) if (key.objectid != dir->i_ino || key.type != BTRFS_INODE_REF_KEY)
goto out; return ERR_PTR(-EINVAL);
objectid = key.offset; objectid = key.offset;
...@@ -201,10 +210,6 @@ static struct dentry *btrfs_get_parent(struct dentry *child) ...@@ -201,10 +210,6 @@ static struct dentry *btrfs_get_parent(struct dentry *child)
parent = ERR_PTR(-ENOMEM); parent = ERR_PTR(-ENOMEM);
return parent; return parent;
out:
btrfs_free_path(path);
return ERR_PTR(-EINVAL);
} }
const struct export_operations btrfs_export_ops = { const struct export_operations btrfs_export_ops = {
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment