Wang Shilong
2014-Jan-20 08:44 UTC
[PATCH] Btrfs-progs: fix double free when deleting subvolumes
Steps to reproduce:
# mkfs.btrfs -f /dev/sda8
# mount /dev/sda8 /mnt
# btrfs sub create /mnt/a
# touch /mnt/b
# btrfs sub create /mnt/c
# btrfs sub delete /mnt/*
Above steps will trigger following abortion:
ERROR: 'b' is not a subvolume
*** Error in `btrfs': double free or corruption (out): 0x0000000002116060
***
======= Backtrace: ========/lib64/libc.so.6[0x3fa467cef8]
/lib64/libc.so.6(closedir+0xd)[0x3fa46b846d]
btrfs[0x43e608]
btrfs[0x40622f]
btrfs[0x403d19]
btrfs[0x4062c6]
btrfs[0x403f68]
We try to fix it by resetting @fd && @dirstream before trying next
subvolume deletion.
Signed-off-by: Wang Shilong <wangsl.fnst@cn.fujitsu.com>
---
cmds-subvolume.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/cmds-subvolume.c b/cmds-subvolume.c
index 38229d0..61a78fa 100644
--- a/cmds-subvolume.c
+++ b/cmds-subvolume.c
@@ -354,6 +354,9 @@ out:
cnt++;
if (cnt < argc) {
close_file_or_dir(fd, dirstream);
+ /* avoid double free */
+ fd = -1;
+ dirstream = NULL;
goto again;
}
--
1.8.3.1
--
To unsubscribe from this list: send the line "unsubscribe linux-btrfs"
in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html