diff options
| author | Wang Shilong <wangsl.fnst@cn.fujitsu.com> | 2014-01-20 16:44:21 +0800 |
|---|---|---|
| committer | Chris Mason <clm@fb.com> | 2014-01-31 08:22:29 -0800 |
| commit | cf822f5dbaddb02a6e9a9b25e5979195f935f02e (patch) | |
| tree | 2d67f05d8a98f9fffb24625270ed34237e143371 /cmds-subvolume.c | |
| parent | 0511ca4b502f1cbdd5e92c287d97c8356cdaff66 (diff) | |
Btrfs-progs: fix double free when deleting subvolumes
Steps to reproduce:
# mkfs.btrfs -f /dev/sda8
# mount /dev/sda8 /mnt
# btrfs sub create /mnt/a
# touch /mnt/b
# btrfs sub create /mnt/c
# btrfs sub delete /mnt/*
Above steps will trigger following abortion:
ERROR: 'b' is not a subvolume
*** Error in `btrfs': double free or corruption (out): 0x0000000002116060 ***
======= Backtrace: =========
/lib64/libc.so.6[0x3fa467cef8]
/lib64/libc.so.6(closedir+0xd)[0x3fa46b846d]
btrfs[0x43e608]
btrfs[0x40622f]
btrfs[0x403d19]
btrfs[0x4062c6]
btrfs[0x403f68]
We try to fix it by resetting @fd && @dirstream before trying next
subvolume deletion.
Signed-off-by: Wang Shilong <wangsl.fnst@cn.fujitsu.com>
Signed-off-by: David Sterba <dsterba@suse.cz>
Signed-off-by: Chris Mason <clm@fb.com>
Diffstat (limited to 'cmds-subvolume.c')
| -rw-r--r-- | cmds-subvolume.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/cmds-subvolume.c b/cmds-subvolume.c index 0c5b6038..0bd76f2e 100644 --- a/cmds-subvolume.c +++ b/cmds-subvolume.c @@ -354,6 +354,9 @@ out: cnt++; if (cnt < argc) { close_file_or_dir(fd, dirstream); + /* avoid double free */ + fd = -1; + dirstream = NULL; goto again; } |