Btrfs-progs: fix double free when deleting subvolumes

Steps to reproduce:
	# mkfs.btrfs -f /dev/sda8
	# mount /dev/sda8 /mnt
	# btrfs sub create /mnt/a
	# touch /mnt/b
	# btrfs sub create /mnt/c
	# btrfs sub delete /mnt/*

Above steps will trigger following abortion:

ERROR: 'b' is not a subvolume
*** Error in `btrfs': double free or corruption (out): 0x0000000002116060 ***
======= Backtrace: =========
/lib64/libc.so.6[0x3fa467cef8]
/lib64/libc.so.6(closedir+0xd)[0x3fa46b846d]
btrfs[0x43e608]
btrfs[0x40622f]
btrfs[0x403d19]
btrfs[0x4062c6]
btrfs[0x403f68]

We try to fix it by resetting @fd && @dirstream before trying next
subvolume deletion.

Signed-off-by: Wang Shilong <wangsl.fnst@cn.fujitsu.com>
Signed-off-by: David Sterba <dsterba@suse.cz>
Signed-off-by: Chris Mason <clm@fb.com>

diff --git a/cmds-subvolume.c b/cmds-subvolume.c
index 0c5b603809debf2c1d366be972929773b8815223..0bd76f2e13183a21404676d2266b5d95dcf78bb8 100644 (file)
--- a/cmds-subvolume.c
+++ b/cmds-subvolume.c
@@ -354,6 +354,9 @@ out:
        cnt++;
        if (cnt < argc) {
                close_file_or_dir(fd, dirstream);
+               /* avoid double free */
+               fd = -1;
+               dirstream = NULL;
                goto again;
        }