From 99ac0d5732668b95c3cab0ad20266562126d27f9 Mon Sep 17 00:00:00 2001 From: Satoru Takeuchi Date: Tue, 24 Jun 2014 16:30:21 +0900 Subject: [PATCH] btrfs-progs: Avoid double-free of fs_devices->list I found the following patch is insufficient. =============================================================================== commit 6e6b32ddf58db54f714d0f263c2589f4859e8b5e Author: Adam Buchbinder Date: Fri Jun 13 16:43:56 2014 -0700 btrfs-progs: Fix a use-after-free in the volumes code. =============================================================================== "btrfs filesystem show " with this patch causes segmentation fault if "" is a not-mounted Btrfs filesystem. =============================================================================== Label: none uuid: Total devices 1 FS bytes used 112.00KiB devid 1 size 59.12GiB used 2.04GiB path /dev/sdd1 Segmentation fault (core dumped) =============================================================================== It's due to double-free of fs_devices->list as follows. =============================================================================== cmd_show -> list_del(&fs_devices->list) # 1st one. -> btrfs_close_devices(fs_devices) -> list_del(&fs_devices->list) # <- 2nd one introduced at 6e6b32dd. Double-free happens here. =============================================================================== First list_del() can safely be removed because fs_devices->list will be deleted by second one, soon. Signed-off-by: Satoru Takeuchi Cc: Adam Buchbinder Signed-off-by: David Sterba --- cmds-filesystem.c | 1 - 1 file changed, 1 deletion(-) diff --git a/cmds-filesystem.c b/cmds-filesystem.c index 888e3ec..6d7c13e 100644 --- a/cmds-filesystem.c +++ b/cmds-filesystem.c @@ -656,7 +656,6 @@ devs_only: while (!list_empty(all_uuids)) { fs_devices = list_entry(all_uuids->next, struct btrfs_fs_devices, list); - list_del(&fs_devices->list); btrfs_close_devices(fs_devices); } out: -- 2.7.4