gfs2-utils: RHEL7 - fsck.gfs2: fix double-free bug

Andrew Price andyp at fedoraproject.org
Tue Apr 7 21:23:31 UTC 2015


Gitweb:        http://git.fedorahosted.org/git/?p=gfs2-utils.git;a=commitdiff;h=cc49c36caffdffe4c2d6fe8fbde0a6813081267d
Commit:        cc49c36caffdffe4c2d6fe8fbde0a6813081267d
Parent:        3ef35f4d0deeabfe9fdbc7939ae8dc6ae7dfb11f
Author:        Bob Peterson <rpeterso at redhat.com>
AuthorDate:    Thu Jan 15 09:49:12 2015 -0600
Committer:     Andrew Price <anprice at redhat.com>
CommitterDate: Wed Apr 1 16:51:35 2015 +0100

fsck.gfs2: fix double-free bug

This patch fixes a double-free bug that can occur when errors are found
in an inode and later, it's freed. The problem is that function
free_metalist was using osi_list_del when removing buffer_heads from the
inode in memory. It should be using osi_list_del_init so that the list
head is reinitialized. Otherwise the list head is left with an unknown
value which gets interpreted later on as !list_empty(), so it tries to
free the list a second time.

This also fixes a minor issue with function rangecheck_jmeta, which
frees the buffer_head when it hits an error. The patch sets the returned
*bh value back to NULL to ensure it's not reused. This is just a
precaution I spotted while debugging, and it's worth doing.
---
 gfs2/fsck/fs_recovery.c |    1 +
 gfs2/fsck/metawalk.c    |    2 +-
 2 files changed, 2 insertions(+), 1 deletions(-)

diff --git a/gfs2/fsck/fs_recovery.c b/gfs2/fsck/fs_recovery.c
index 3d8fe98..095d118 100644
--- a/gfs2/fsck/fs_recovery.c
+++ b/gfs2/fsck/fs_recovery.c
@@ -631,6 +631,7 @@ static int rangecheck_jmeta(struct gfs2_inode *ip, uint64_t block,
 				 (unsigned long long)block,
 				 (unsigned long long)block);
 			brelse(*bh);
+			*bh = NULL;
 			return meta_skip_further;
 		}
 	}
diff --git a/gfs2/fsck/metawalk.c b/gfs2/fsck/metawalk.c
index 4d16623..289b062 100644
--- a/gfs2/fsck/metawalk.c
+++ b/gfs2/fsck/metawalk.c
@@ -1203,7 +1203,7 @@ static void free_metalist(struct gfs2_inode *ip, osi_list_t *mlp)
 			nbh = osi_list_entry(list->next,
 					     struct gfs2_buffer_head, b_altlist);
 			if (nbh == ip->i_bh)
-				osi_list_del(&nbh->b_altlist);
+				osi_list_del_init(&nbh->b_altlist);
 			else
 				brelse(nbh);
 		}


More information about the cluster-commits mailing list