[PATCH 09/13] btrfs: modify the new_root highest_objectid under a ref count

[Josef Bacik]

Qu pointed out a bug in one of my error handling patches, which made me
notice that we modify the new_root->highest_objectid _after_ we've
dropped the ref to the new_root.  This could lead to a possible UAF, fix
this by modifying the ->highest_objectid before we drop our reference to
the new_root.

Signed-off-by: Josef Bacik <jo...@toxicpanda.com>
---
 fs/btrfs/ioctl.c | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c
index dde49a791f3e..af8d01659562 100644
--- a/fs/btrfs/ioctl.c
+++ b/fs/btrfs/ioctl.c
@@ -717,6 +717,12 @@ static noinline int create_subvol(struct inode *dir,
        btrfs_record_root_in_trans(trans, new_root);
 
        ret = btrfs_create_subvol_root(trans, new_root, root, new_dirid);
+       if (!ret) {
+               mutex_lock(&new_root->objectid_mutex);
+               new_root->highest_objectid = new_dirid;
+               mutex_unlock(&new_root->objectid_mutex);
+       }
+
        btrfs_put_root(new_root);
        if (ret) {
                /* We potentially lose an unused inode item here */
@@ -724,10 +730,6 @@ static noinline int create_subvol(struct inode *dir,
                goto fail;
        }
 
-       mutex_lock(&new_root->objectid_mutex);
-       new_root->highest_objectid = new_dirid;
-       mutex_unlock(&new_root->objectid_mutex);
-
        /*
         * insert the directory item
         */
-- 
2.26.2