summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorWang Shilong <wangsl.fnst@cn.fujitsu.com>2014-01-20 16:44:21 +0800
committerChris Mason <clm@fb.com>2014-01-31 08:22:29 -0800
commitcf822f5dbaddb02a6e9a9b25e5979195f935f02e (patch)
tree2d67f05d8a98f9fffb24625270ed34237e143371
parent0511ca4b502f1cbdd5e92c287d97c8356cdaff66 (diff)
Btrfs-progs: fix double free when deleting subvolumes
Steps to reproduce: # mkfs.btrfs -f /dev/sda8 # mount /dev/sda8 /mnt # btrfs sub create /mnt/a # touch /mnt/b # btrfs sub create /mnt/c # btrfs sub delete /mnt/* Above steps will trigger following abortion: ERROR: 'b' is not a subvolume *** Error in `btrfs': double free or corruption (out): 0x0000000002116060 *** ======= Backtrace: ========= /lib64/libc.so.6[0x3fa467cef8] /lib64/libc.so.6(closedir+0xd)[0x3fa46b846d] btrfs[0x43e608] btrfs[0x40622f] btrfs[0x403d19] btrfs[0x4062c6] btrfs[0x403f68] We try to fix it by resetting @fd && @dirstream before trying next subvolume deletion. Signed-off-by: Wang Shilong <wangsl.fnst@cn.fujitsu.com> Signed-off-by: David Sterba <dsterba@suse.cz> Signed-off-by: Chris Mason <clm@fb.com>
-rw-r--r--cmds-subvolume.c3
1 files changed, 3 insertions, 0 deletions
diff --git a/cmds-subvolume.c b/cmds-subvolume.c
index 0c5b6038..0bd76f2e 100644
--- a/cmds-subvolume.c
+++ b/cmds-subvolume.c
@@ -354,6 +354,9 @@ out:
cnt++;
if (cnt < argc) {
close_file_or_dir(fd, dirstream);
+ /* avoid double free */
+ fd = -1;
+ dirstream = NULL;
goto again;
}