From: Ilya Dryomov <idryomov@gmail.com>
Date: Wed, 2 Oct 2013 17:41:01 +0000 (+0300)
Subject: Btrfs: fix a use-after-free bug in btrfs_dev_replace_finishing
X-Git-Tag: v3.12-rc4~4^2~1^2
X-Git-Url: http://git.openpandora.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=1357272fc7deeebb7b3c5d1a071562edc273cdaf;p=pandora-kernel.git

Btrfs: fix a use-after-free bug in btrfs_dev_replace_finishing

free_device rcu callback, scheduled from btrfs_rm_dev_replace_srcdev,
can be processed before btrfs_scratch_superblock is called, which would
result in a use-after-free on btrfs_device contents.  Fix this by
zeroing the superblock before the rcu callback is registered.

Cc: Stefan Behrens <sbehrens@giantdisaster.de>
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Signed-off-by: Josef Bacik <jbacik@fusionio.com>
---

Reading git-diff-tree failed