summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorKent Overstreet <kent.overstreet@gmail.com>2016-09-16 07:16:51 -0800
committerKent Overstreet <kent.overstreet@gmail.com>2016-09-16 07:16:51 -0800
commit088cb2b3cb26baab7e12a3550efa8ac3b236fa2e (patch)
treef03677a81393d5a62c58f92c3d2a6a125c5d64bc
parent58e239ee3991422245ececa1e4ca541d83da2438 (diff)
bcache: Fix a use after free in the gzip code
the zlib api is hateful
-rw-r--r--drivers/md/bcache/compress.c20
1 files changed, 12 insertions, 8 deletions
diff --git a/drivers/md/bcache/compress.c b/drivers/md/bcache/compress.c
index 048ef7581b23..a4f30bc32e64 100644
--- a/drivers/md/bcache/compress.c
+++ b/drivers/md/bcache/compress.c
@@ -321,23 +321,27 @@ static struct bio *__bio_compress(struct cache_set *c,
Z_DEFAULT_STRATEGY);
ret = zlib_deflate(&strm, Z_FINISH);
-
- if (workspace == c->zlib_workspace)
- mutex_unlock(&c->zlib_workspace_lock);
- else
- kfree(workspace);
-
if (ret != Z_STREAM_END) {
ret = -EIO;
- goto err;
+ goto zlib_err;
}
ret = zlib_deflateEnd(&strm);
if (ret != Z_OK) {
ret = -EIO;
- goto err;
+ goto zlib_err;
}
+ ret = 0;
+zlib_err:
+ if (workspace == c->zlib_workspace)
+ mutex_unlock(&c->zlib_workspace_lock);
+ else
+ kfree(workspace);
+
+ if (ret)
+ goto err;
+
BUG_ON(strm.total_in != output_available);
dst->bi_iter.bi_size = strm.total_out;