diff options
| author | Qu Wenruo <wqu@suse.com> | 2018-08-03 13:50:22 +0800 |
|---|---|---|
| committer | David Sterba <dsterba@suse.com> | 2018-10-23 14:48:40 +0200 |
| commit | 5d24e630b0e691e60fc8bfffa68558daf8c98277 (patch) | |
| tree | 930af153df11dfa951eb433d3bddfd4ef19eacc0 /super-recover.c | |
| parent | 40073c3ca97b929e3345802896eaaf0165ed7f83 (diff) | |
btrfs-progs: rescue-super: don't double free fs_devices
[BUG]
During fuzz/007 we hit the following error:
====== RUN MAYFAIL btrfs rescue super-recover -y -v tests/fuzz-tests/images/bko-200409.raw.restored.scratch
ERROR: tree_root block unaligned: 33554431
ERROR: superblock checksum matches but it has invalid members
ERROR: tree_root block unaligned: 33554431
ERROR: superblock checksum matches but it has invalid members
ERROR: tree_root block unaligned: 33554431
ERROR: superblock checksum matches but it has invalid members
ERROR: failed to add chunk map start=12582912 len=8454144: -17 (File exists)
Couldn't read chunk tree
failed (ignored, ret=139): btrfs rescue super-recover -y -v tests/fuzz-tests/images/bko-200409.raw.restored.scratch
mayfail: returned code 139 (SEGFAULT), not ignored
test failed for case 007-simple-super-recover
[CAUSE]
In __open_ctree_fd(), if we have valid @open_ctree_flags and
btrfs_scan_fs_devices() succeeds without problems, no matter what
happens we will call btrfs_close_devices(), thus free all related
devices.
In super-recover, before we call open_ctree(), we have called
btrfs_scan_fs_devices() already, so btrfs_scan_fs_devices() should not
fail in open_ctree(), fs_devices will always be freed in open_ctree() or
close_ctree().
[FIX]
So in super-recover.c, we should not call btrfs_close_devices(), or we
will find fs_devices->list freed, and trigger segfault when exiting.
Signed-off-by: Qu Wenruo <wqu@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Diffstat (limited to 'super-recover.c')
| -rw-r--r-- | super-recover.c | 3 |
1 files changed, 0 insertions, 3 deletions
diff --git a/super-recover.c b/super-recover.c index 880fd771..86b3df98 100644 --- a/super-recover.c +++ b/super-recover.c @@ -292,9 +292,6 @@ int btrfs_recover_superblocks(const char *dname, no_recover: recover_err_str(ret); free_recover_superblock(&recover); - /* check if we have freed fs_devices in close_ctree() */ - if (!root) - btrfs_close_devices(recover.fs_devices); return ret; } |