diff options
| author | Kent Overstreet <kent.overstreet@gmail.com> | 2016-09-16 07:16:51 -0800 |
|---|---|---|
| committer | Kent Overstreet <kent.overstreet@gmail.com> | 2016-10-07 12:37:06 -0800 |
| commit | 815eb8c46611b334b96ea8033359cf332a65e775 (patch) | |
| tree | a0063e168d53e7cfe09296835b4998c2956dfe31 | |
| parent | 9db33be8aabf1282e25ea2efa40d335167123c98 (diff) | |
bcache: Fix a use after free in the gzip code
the zlib api is hateful
| -rw-r--r-- | drivers/md/bcache/compress.c | 20 |
1 files changed, 12 insertions, 8 deletions
diff --git a/drivers/md/bcache/compress.c b/drivers/md/bcache/compress.c index 048ef7581b23..a4f30bc32e64 100644 --- a/drivers/md/bcache/compress.c +++ b/drivers/md/bcache/compress.c @@ -321,23 +321,27 @@ static struct bio *__bio_compress(struct cache_set *c, Z_DEFAULT_STRATEGY); ret = zlib_deflate(&strm, Z_FINISH); - - if (workspace == c->zlib_workspace) - mutex_unlock(&c->zlib_workspace_lock); - else - kfree(workspace); - if (ret != Z_STREAM_END) { ret = -EIO; - goto err; + goto zlib_err; } ret = zlib_deflateEnd(&strm); if (ret != Z_OK) { ret = -EIO; - goto err; + goto zlib_err; } + ret = 0; +zlib_err: + if (workspace == c->zlib_workspace) + mutex_unlock(&c->zlib_workspace_lock); + else + kfree(workspace); + + if (ret) + goto err; + BUG_ON(strm.total_in != output_available); dst->bi_iter.bi_size = strm.total_out; |