RepoMirrors/btrfs-progs
1
0
Fork 0
mirror of https://github.com/kdave/btrfs-progs synced 2025-03-25 04:16:32 +00:00
Code Issues Packages Projects Releases Wiki Activity

Fix use after free in close_ctree

Browse Source 
After the roots are closed, root is freed. Yet close_ctree continues
to use it. It works generally because no new memory is allocated in
the interim, but with glibc malloc perturbing enabled, it crashes
every time. This is because root->fs_info points to garbage.

This patch uses the already-cached fs_info variable for the rest of
the accesses and fixes the crash.

This issue was reported at:
https://bugzilla.novell.com/show_bug.cgi?id=603620

Signed-off-by: Jeff Mahoney <jeffm@suse.com>
This commit is contained in:
Jeff Mahoney 2010-09-09 14:06:09 +08:00 committed by Chris Mason
parent b227b4dd7c
commit bba632af0e
1 changed files with 5 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
disk-io.c
View File

@ -970,13 +970,13 @@ int close_ctree(struct btrfs_root *root)
if (fs_info->csum_root->node)
free_extent_buffer(fs_info->csum_root->node);
if (root->fs_info->log_root_tree) {
if (root->fs_info->log_root_tree->node)
free_extent_buffer(root->fs_info->log_root_tree->node);
free(root->fs_info->log_root_tree);
if (fs_info->log_root_tree) {
if (fs_info->log_root_tree->node)
free_extent_buffer(fs_info->log_root_tree->node);
free(fs_info->log_root_tree);
}
close_all_devices(root->fs_info);
close_all_devices(fs_info);
extent_io_tree_cleanup(&fs_info->extent_cache);
extent_io_tree_cleanup(&fs_info->free_space_cache);
extent_io_tree_cleanup(&fs_info->block_group_cache);