diff options
| author | Jeff Mahoney <jeffm@suse.com> | 2011-10-03 23:23:23 -0400 |
|---|---|---|
| committer | David Sterba <dsterba@suse.cz> | 2012-03-22 01:45:30 +0100 |
| commit | cddcd800189bc03745d576f913dc57692c6f439a (patch) | |
| tree | 361ed5f8c26a9820608de6d0a74f546729c90970 | |
| parent | 43c04fb1b8c9f45d971bb53d7cbbcda8ee85716b (diff) | |
btrfs: Fix kfree of member instead of structure
Correctness fix: The kfree calls in the add_delayed_* functions free
the node that's passed into it, but the node is a member of another
structure. It works because it's always the first member of the
containing structure, but it should really be using the containing
structure itself.
Signed-off-by: Jeff Mahoney <jeffm@suse.com>
| -rw-r--r-- | fs/btrfs/delayed-ref.c | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/fs/btrfs/delayed-ref.c b/fs/btrfs/delayed-ref.c index 66e4f29505a..29ecd543d80 100644 --- a/fs/btrfs/delayed-ref.c +++ b/fs/btrfs/delayed-ref.c @@ -487,7 +487,7 @@ static noinline int add_delayed_ref_head(struct btrfs_fs_info *fs_info, * we've updated the existing ref, free the newly * allocated ref */ - kfree(ref); + kfree(head_ref); } else { delayed_refs->num_heads++; delayed_refs->num_heads_ready++; @@ -549,7 +549,7 @@ static noinline int add_delayed_tree_ref(struct btrfs_fs_info *fs_info, * we've updated the existing ref, free the newly * allocated ref */ - kfree(ref); + kfree(full_ref); } else { delayed_refs->num_entries++; trans->delayed_ref_updates++; @@ -611,7 +611,7 @@ static noinline int add_delayed_data_ref(struct btrfs_fs_info *fs_info, * we've updated the existing ref, free the newly * allocated ref */ - kfree(ref); + kfree(full_ref); } else { delayed_refs->num_entries++; trans->delayed_ref_updates++; |