From cf822f5dbaddb02a6e9a9b25e5979195f935f02e Mon Sep 17 00:00:00 2001 From: Wang Shilong Date: Mon, 20 Jan 2014 16:44:21 +0800 Subject: Btrfs-progs: fix double free when deleting subvolumes Steps to reproduce: # mkfs.btrfs -f /dev/sda8 # mount /dev/sda8 /mnt # btrfs sub create /mnt/a # touch /mnt/b # btrfs sub create /mnt/c # btrfs sub delete /mnt/* Above steps will trigger following abortion: ERROR: 'b' is not a subvolume *** Error in `btrfs': double free or corruption (out): 0x0000000002116060 *** ======= Backtrace: ========= /lib64/libc.so.6[0x3fa467cef8] /lib64/libc.so.6(closedir+0xd)[0x3fa46b846d] btrfs[0x43e608] btrfs[0x40622f] btrfs[0x403d19] btrfs[0x4062c6] btrfs[0x403f68] We try to fix it by resetting @fd && @dirstream before trying next subvolume deletion. Signed-off-by: Wang Shilong Signed-off-by: David Sterba Signed-off-by: Chris Mason --- cmds-subvolume.c | 3 +++ 1 file changed, 3 insertions(+) (limited to 'cmds-subvolume.c') diff --git a/cmds-subvolume.c b/cmds-subvolume.c index 0c5b6038..0bd76f2e 100644 --- a/cmds-subvolume.c +++ b/cmds-subvolume.c @@ -354,6 +354,9 @@ out: cnt++; if (cnt < argc) { close_file_or_dir(fd, dirstream); + /* avoid double free */ + fd = -1; + dirstream = NULL; goto again; } -- cgit v1.2.3