From: Jiri Slaby <jirislaby@gmail.com>
Date: Thu, 2 Jul 2009 17:50:58 +0000 (-0400)
Subject: Btrfs: fix use after free in btrfs_start_workers fail path
X-Git-Tag: v2.6.31-rc2~10^2~1
X-Git-Url: https://openfabrics.org/gitweb/?a=commitdiff_plain;h=9b627e9bf49ebfeb060dfae0435bdba06cf27cb8;p=~emulex%2Finfiniband.git

Btrfs: fix use after free in btrfs_start_workers fail path

worker memory is already freed on one fail path in btrfs_start_workers,
but is still dereferenced. Switch the dereference and kfree.

Signed-off-by: Jiri Slaby <jirislaby@gmail.com>
Signed-off-by: Chris Mason <chris.mason@oracle.com>
---

diff --git a/fs/btrfs/async-thread.c b/fs/btrfs/async-thread.c
index 7f88628a1a7..6e4f6c50a12 100644
--- a/fs/btrfs/async-thread.c
+++ b/fs/btrfs/async-thread.c
@@ -299,8 +299,8 @@ int btrfs_start_workers(struct btrfs_workers *workers, int num_workers)
 					   "btrfs-%s-%d", workers->name,
 					   workers->num_workers + i);
 		if (IS_ERR(worker->task)) {
-			kfree(worker);
 			ret = PTR_ERR(worker->task);
+			kfree(worker);
 			goto fail;
 		}