Gitweb:
http://git.fedorahosted.org/git/?p=gfs2-utils.git;a=commitdiff;h=818232fb...
Commit: 818232fbf5b4adb48488877abc7c022894372cd8
Parent: 9c750fe0f06a9ab1b7d36c68041d0a61d8cdcede
Author: Bob Peterson <rpeterso(a)redhat.com>
AuthorDate: Thu Jan 15 09:49:12 2015 -0600
Committer: Bob Peterson <rpeterso(a)redhat.com>
CommitterDate: Thu Jan 15 10:39:17 2015 -0600
fsck.gfs2: fix double-free bug
This patch fixes a double-free bug that can occur when errors are found
in an inode and later, it's freed. The problem is that function
free_metalist was using osi_list_del when removing buffer_heads from the
inode in memory. It should be using osi_list_del_init so that the list
head is reinitialized. Otherwise the list head is left with an unknown
value which gets interpreted later on as !list_empty(), so it tries to
free the list a second time.
This also fixes a minor issue with function rangecheck_jmeta, which
frees the buffer_head when it hits an error. The patch sets the returned
*bh value back to NULL to ensure it's not reused. This is just a
precaution I spotted while debugging, and it's worth doing.
---
gfs2/fsck/fs_recovery.c | 1 +
gfs2/fsck/metawalk.c | 2 +-
2 files changed, 2 insertions(+), 1 deletions(-)
diff --git a/gfs2/fsck/fs_recovery.c b/gfs2/fsck/fs_recovery.c
index 3d8fe98..095d118 100644
--- a/gfs2/fsck/fs_recovery.c
+++ b/gfs2/fsck/fs_recovery.c
@@ -631,6 +631,7 @@ static int rangecheck_jmeta(struct gfs2_inode *ip, uint64_t block,
(unsigned long long)block,
(unsigned long long)block);
brelse(*bh);
+ *bh = NULL;
return meta_skip_further;
}
}
diff --git a/gfs2/fsck/metawalk.c b/gfs2/fsck/metawalk.c
index 1875b24..16faafb 100644
--- a/gfs2/fsck/metawalk.c
+++ b/gfs2/fsck/metawalk.c
@@ -1203,7 +1203,7 @@ static void free_metalist(struct gfs2_inode *ip, osi_list_t *mlp)
nbh = osi_list_entry(list->next,
struct gfs2_buffer_head, b_altlist);
if (nbh == ip->i_bh)
- osi_list_del(&nbh->b_altlist);
+ osi_list_del_init(&nbh->b_altlist);
else
brelse(nbh);
}