RepoMirrors/btrfs-progs
1
0
Fork 0
mirror of https://github.com/kdave/btrfs-progs synced 2025-02-27 15:30:44 +00:00
Code Issues Packages Projects Releases Wiki Activity

btrfs-progs: Avoid double-free of fs_devices->list

Browse Source 
I found the following patch is insufficient.

===============================================================================
commit 6e6b32ddf58db54f714d0f263c2589f4859e8b5e
Author: Adam Buchbinder <abuchbinder@google.com>
Date:   Fri Jun 13 16:43:56 2014 -0700

    btrfs-progs: Fix a use-after-free in the volumes code.
===============================================================================

"btrfs filesystem show <dev>" with this patch causes segmentation fault
if "<dev>" is a not-mounted Btrfs filesystem.

===============================================================================
Label: none  uuid: <cut here>
        Total devices 1 FS bytes used 112.00KiB
        devid    1 size 59.12GiB used 2.04GiB path /dev/sdd1

Segmentation fault (core dumped)
===============================================================================

It's due to double-free of fs_devices->list as follows.

===============================================================================
cmd_show
  -> list_del(&fs_devices->list)     # 1st one.
  -> btrfs_close_devices(fs_devices)
    -> list_del(&fs_devices->list)   # <- 2nd one introduced at 6e6b32dd.
                                          Double-free happens here.
===============================================================================

First list_del() can safely be removed because fs_devices->list will be
deleted by second one, soon.

Signed-off-by: Satoru Takeuchi <takeuchi_satoru@jp.fujitsu.com>
Cc: Adam Buchbinder <abuchbinder@google.com>
Signed-off-by: David Sterba <dsterba@suse.cz>
This commit is contained in:
Satoru Takeuchi 2014-06-24 16:30:21 +09:00 committed by David Sterba
parent 5da89caa81
commit 99ac0d5732
1 changed files with 0 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
cmds-filesystem.c
View File

@ -656,7 +656,6 @@ devs_only:
while (!list_empty(all_uuids)) {
fs_devices = list_entry(all_uuids->next,
struct btrfs_fs_devices, list);
list_del(&fs_devices->list);
btrfs_close_devices(fs_devices);
}
out: