Skip to contentSkip to conversation

xfs: avoid double-free in xfs_attr_node_addname

PATCH Applied Eric Sandeen 3 participants 3 messages Aug 1, 2013 – Aug 13, 2013 XFS filesystem

lore
Share & tools
lore

Eric Sandeen

author
#0 lore raw

PATCH 1/1 xfs: avoid double-free in xfs_attr_node_addname

xfs_attr_node_addname()'s error handling tests whether it should free "state" in the out: error handling label:

out:

        if (state)
                xfs_da_state_free(state);

but an earlier free doesn't set state to NULL afterwards; this could lead to a double free. Fix it by setting state to NULL after it's freed.

This was found by Coverity.

Signed-off-by Eric Sandeen <[email protected]>

---

Note: Exact same patch should hit xfsprogs - I could send another, or maybe SGI can just apply it in both trees?

Thanks,
-Eric

fs/xfs/xfs_attr.c +1 -0
index 20fe3fe..aaff8a9 100644
@@ -1260,6 +1260,7 @@ restart:
 			 * have been a b-tree.
 			 */
 			xfs_da_state_free(state);
+			state = NULL;
 			xfs_bmap_init(args->flist, args->firstblock);
 			error = xfs_attr3_leaf_to_node(args);
 			if (!error) {

_______________________________________________
xfs mailing list
[email protected]
http://oss.sgi.com/mailman/listinfo/xfs

Reviewed-by on v1 1/1
#1 lore raw
Quoted 13 lines · Eric Sandeen

xfs_attr_node_addname()'s error handling tests whether it should free "state" in the out: error handling label:

out:

         if (state)
                 xfs_da_state_free(state);

but an earlier free doesn't set state to NULL afterwards; this could lead to a double free. Fix it by setting state to NULL after it's freed.

This was found by Coverity.

Quoted 8 lines
Signed-off-by Eric Sandeen<[email protected]>

---

Note: Exact same patch should hit xfsprogs - I could send another, or maybe SGI can just apply it in both trees?

Thanks,
-Eric

Looks good. we will discuss the details at PM phone call.

Reviewed-by Mark Tinguely <[email protected]>

_______________________________________________
xfs mailing list
[email protected]
http://oss.sgi.com/mailman/listinfo/xfs

Applied
#2 lore raw
In reply to Eric Sandeen
Quoted 7 lines · Eric Sandeen

xfs_attr_node_addname()'s error handling tests whether it should free "state" in the out: error handling label:

out:

        if (state)
                xfs_da_state_free(state);
Quoted 7 lines

but an earlier free doesn't set state to NULL afterwards; this could lead to a double free. Fix it by setting state to NULL after it's freed.

This was found by Coverity.

Signed-off-by Eric Sandeen <[email protected]>

Applied.

_______________________________________________
xfs mailing list
[email protected]
http://oss.sgi.com/mailman/listinfo/xfs