summaryrefslogtreecommitdiff
path: root/btrfs-image.c
diff options
context:
space:
mode:
authorSatoru Takeuchi <takeuchi_satoru@jp.fujitsu.com>2014-06-24 16:30:21 +0900
committerDavid Sterba <dsterba@suse.cz>2014-08-22 14:43:11 +0200
commit99ac0d5732668b95c3cab0ad20266562126d27f9 (patch)
treee22c15cd1e6f60b582b24abbd8dbe0d62c72df05 /btrfs-image.c
parent5da89caa81e7e7068cf4c0a7b09b329598e4bc2c (diff)
btrfs-progs: Avoid double-free of fs_devices->list
I found the following patch is insufficient. =============================================================================== commit 6e6b32ddf58db54f714d0f263c2589f4859e8b5e Author: Adam Buchbinder <abuchbinder@google.com> Date: Fri Jun 13 16:43:56 2014 -0700 btrfs-progs: Fix a use-after-free in the volumes code. =============================================================================== "btrfs filesystem show <dev>" with this patch causes segmentation fault if "<dev>" is a not-mounted Btrfs filesystem. =============================================================================== Label: none uuid: <cut here> Total devices 1 FS bytes used 112.00KiB devid 1 size 59.12GiB used 2.04GiB path /dev/sdd1 Segmentation fault (core dumped) =============================================================================== It's due to double-free of fs_devices->list as follows. =============================================================================== cmd_show -> list_del(&fs_devices->list) # 1st one. -> btrfs_close_devices(fs_devices) -> list_del(&fs_devices->list) # <- 2nd one introduced at 6e6b32dd. Double-free happens here. =============================================================================== First list_del() can safely be removed because fs_devices->list will be deleted by second one, soon. Signed-off-by: Satoru Takeuchi <takeuchi_satoru@jp.fujitsu.com> Cc: Adam Buchbinder <abuchbinder@google.com> Signed-off-by: David Sterba <dsterba@suse.cz>
Diffstat (limited to 'btrfs-image.c')
0 files changed, 0 insertions, 0 deletions