Skip to contentSkip to conversation

Avoid double-free of fs_devices->list.

PATCH New Satoru Takeuchi 1 participant 1 message Jun 24, 2014 Btrfs file system

lore
Share & tools
lore
#0 lore raw

PATCH 1/1 Avoid double-free of fs_devices->list.

I found the following patch is insufficient.

===============================================================================
commit 6e6b32ddf58db54f714d0f263c2589f4859e8b5e

Author: Adam Buchbinder <[email protected]>
Date:   Fri Jun 13 16:43:56 2014 -0700

btrfs-progs: Fix a use-after-free in the volumes code.
===============================================================================

"btrfs filesystem show <dev>" with this patch causes segmentation fault if "<dev>" is a not-mounted Btrfs filesystem.

===============================================================================

# ./btrfs filesystem show /dev/sdd1
Label: none  uuid: <cut here>
        Total devices 1 FS bytes used 112.00KiB
        devid    1 size 59.12GiB used 2.04GiB path /dev/sdd1

Segmentation fault (core dumped)
===============================================================================

It's due to double-free of fs_devices->list as follows.

===============================================================================
cmd_show
-> list_del(&fs_devices->list) # 1st one.
-> btrfs_close_devices(fs_devices)
-> list_del(&fs_devices->list) # <- 2nd one introduced at 6e6b32dd.
Double-free happens here.
===============================================================================

First list_del() can safely be removed because fs_devices->list will be deleted by second one, soon.

---
 cmds-filesystem.c | 1 -
 1 file changed, 1 deletion(-)
cmds-filesystem.c +0 -1
index b1ba508..14cb6e0 100644
@@ -716,7 +716,6 @@ devs_only:
 	while (!list_empty(all_uuids)) {
 		fs_devices = list_entry(all_uuids->next,
 					struct btrfs_fs_devices, list);
-		list_del(&fs_devices->list);
 		btrfs_close_devices(fs_devices);
 	}
 out:
Signature · 1 line
1.9.3