Commit c1ccf967 authored by Darrick J. Wong's avatar Darrick J. Wong
Browse files

xfs: fix uninitialized list head in struct xfs_refcount_recovery 



We're supposed to initialize the list head of an object before adding it
to another list.  Fix that, and stop using the kmem_{alloc,free} calls
from the Irix days.

Fixes: 174edb0e ("xfs: store in-progress CoW allocations in the refcount btree")
Signed-off-by: default avatarDarrick J. Wong <djwong@kernel.org>
Reviewed-by: default avatarDave Chinner <dchinner@redhat.com>
parent f1fdc820

fs/xfs/libxfs/xfs_refcount.c

+6 −4
Original line number Diff line number Diff line
@@ -1767,12 +1767,14 @@ xfs_refcount_recover_extent( 
			   be32_to_cpu(rec->refc.rc_refcount) != 1))

		return -EFSCORRUPTED;



	rr = kmem_alloc(sizeof(struct xfs_refcount_recovery), 0);

	rr = kmalloc(sizeof(struct xfs_refcount_recovery),

			GFP_KERNEL | __GFP_NOFAIL);

	INIT_LIST_HEAD(&rr->rr_list);

	xfs_refcount_btrec_to_irec(rec, &rr->rr_rrec);



	if (XFS_IS_CORRUPT(cur->bc_mp,

			   rr->rr_rrec.rc_domain != XFS_REFC_DOMAIN_COW)) {

		kmem_free(rr);

		kfree(rr);

		return -EFSCORRUPTED;

	}
@@ -1859,7 +1861,7 @@ xfs_refcount_recover_cow_leftovers( 
			goto out_free;



		list_del(&rr->rr_list);

		kmem_free(rr);

		kfree(rr);

	}



	return error;
@@ -1869,7 +1871,7 @@ xfs_refcount_recover_cow_leftovers( 
	/* Free the leftover list */

	list_for_each_entry_safe(rr, n, &debris, rr_list) {

		list_del(&rr->rr_list);

		kmem_free(rr);

		kfree(rr);

	}

	return error;

}