Btrfs: fix crash regarding to ulist_add_merge
authorLiu Bo <bo.li.liu@oracle.com>
Fri, 28 Jun 2013 04:37:45 +0000 (12:37 +0800)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Mon, 12 Aug 2013 01:35:24 +0000 (18:35 -0700)
commit98ad9de66428f3dedb2081c7e0a505489d6feaf4
tree2c071bbb346f7289cfb02f265930adb4c9970c4b
parent62fda513d368032d8f6b0375004032d5c0c6060d
Btrfs: fix crash regarding to ulist_add_merge

commit 35f0399db6658f465b00893bdd13b992a0acfef0 upstream.

Several users reported this crash of NULL pointer or general protection,
the story is that we add a rbtree for speedup ulist iteration, and we
use krealloc() to address ulist growth, and krealloc() use memcpy to copy
old data to new memory area, so it's OK for an array as it doesn't use
pointers while it's not OK for a rbtree as it uses pointers.

So krealloc() will mess up our rbtree and it ends up with crash.

Reviewed-by: Wang Shilong <wangsl-fnst@cn.fujitsu.com>
Signed-off-by: Liu Bo <bo.li.liu@oracle.com>
Signed-off-by: Josef Bacik <jbacik@fusionio.com>
Cc: BJ Quinn <bj@placs.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
fs/btrfs/ulist.c