diff mbox

Btrfs-progs: fix double free when deleting subvolumes

Message ID 1390207461-27997-1-git-send-email-wangsl.fnst@cn.fujitsu.com (mailing list archive)
State Accepted, archived
Headers show

Commit Message

Wang Shilong Jan. 20, 2014, 8:44 a.m. UTC 
Steps to reproduce:
	# mkfs.btrfs -f /dev/sda8
	# mount /dev/sda8 /mnt
	# btrfs sub create /mnt/a
	# touch /mnt/b
	# btrfs sub create /mnt/c
	# btrfs sub delete /mnt/*

Above steps will trigger following abortion:

ERROR: 'b' is not a subvolume
*** Error in `btrfs': double free or corruption (out): 0x0000000002116060 ***
diff mbox

Patch

======= Backtrace: =========
/lib64/libc.so.6[0x3fa467cef8]
/lib64/libc.so.6(closedir+0xd)[0x3fa46b846d]
btrfs[0x43e608]
btrfs[0x40622f]
btrfs[0x403d19]
btrfs[0x4062c6]
btrfs[0x403f68]

We try to fix it by resetting @fd && @dirstream before trying next
subvolume deletion.

Signed-off-by: Wang Shilong <wangsl.fnst@cn.fujitsu.com>
---
 cmds-subvolume.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/cmds-subvolume.c b/cmds-subvolume.c
index 38229d0..61a78fa 100644
--- a/cmds-subvolume.c
+++ b/cmds-subvolume.c
@@ -354,6 +354,9 @@  out:
 	cnt++;
 	if (cnt < argc) {
 		close_file_or_dir(fd, dirstream);
+		/* avoid double free */
+		fd = -1;
+		dirstream = NULL;
 		goto again;
 	}