From cf822f5dbaddb02a6e9a9b25e5979195f935f02e Mon Sep 17 00:00:00 2001
From: Wang Shilong <wangsl.fnst@cn.fujitsu.com>
Date: Mon, 20 Jan 2014 16:44:21 +0800
Subject: [PATCH] Btrfs-progs: fix double free when deleting subvolumes

Steps to reproduce:
	# mkfs.btrfs -f /dev/sda8
	# mount /dev/sda8 /mnt
	# btrfs sub create /mnt/a
	# touch /mnt/b
	# btrfs sub create /mnt/c
	# btrfs sub delete /mnt/*

Above steps will trigger following abortion:

ERROR: 'b' is not a subvolume
*** Error in `btrfs': double free or corruption (out): 0x0000000002116060 ***
======= Backtrace: =========
/lib64/libc.so.6[0x3fa467cef8]
/lib64/libc.so.6(closedir+0xd)[0x3fa46b846d]
btrfs[0x43e608]
btrfs[0x40622f]
btrfs[0x403d19]
btrfs[0x4062c6]
btrfs[0x403f68]

We try to fix it by resetting @fd && @dirstream before trying next
subvolume deletion.

Signed-off-by: Wang Shilong <wangsl.fnst@cn.fujitsu.com>
Signed-off-by: David Sterba <dsterba@suse.cz>
Signed-off-by: Chris Mason <clm@fb.com>
---
 cmds-subvolume.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/cmds-subvolume.c b/cmds-subvolume.c
index 0c5b6038..0bd76f2e 100644
--- a/cmds-subvolume.c
+++ b/cmds-subvolume.c
@@ -354,6 +354,9 @@ out:
 	cnt++;
 	if (cnt < argc) {
 		close_file_or_dir(fd, dirstream);
+		/* avoid double free */
+		fd = -1;
+		dirstream = NULL;
 		goto again;
 	}