gfs2-utils: master - fsck.gfs2: fix double-free bug

Bob Peterson rpeterso at fedoraproject.org
Thu Jan 15 18:34:52 UTC 2015


Gitweb:        http://git.fedorahosted.org/git/?p=gfs2-utils.git;a=commitdiff;h=818232fbf5b4adb48488877abc7c022894372cd8
Commit:        818232fbf5b4adb48488877abc7c022894372cd8
Parent:        9c750fe0f06a9ab1b7d36c68041d0a61d8cdcede
Author:        Bob Peterson <rpeterso at redhat.com>
AuthorDate:    Thu Jan 15 09:49:12 2015 -0600
Committer:     Bob Peterson <rpeterso at redhat.com>
CommitterDate: Thu Jan 15 10:39:17 2015 -0600

fsck.gfs2: fix double-free bug

This patch fixes a double-free bug that can occur when errors are found
in an inode and later, it's freed. The problem is that function
free_metalist was using osi_list_del when removing buffer_heads from the
inode in memory. It should be using osi_list_del_init so that the list
head is reinitialized. Otherwise the list head is left with an unknown
value which gets interpreted later on as !list_empty(), so it tries to
free the list a second time.

This also fixes a minor issue with function rangecheck_jmeta, which
frees the buffer_head when it hits an error. The patch sets the returned
*bh value back to NULL to ensure it's not reused. This is just a
precaution I spotted while debugging, and it's worth doing.
---
 gfs2/fsck/fs_recovery.c |    1 +
 gfs2/fsck/metawalk.c    |    2 +-
 2 files changed, 2 insertions(+), 1 deletions(-)

diff --git a/gfs2/fsck/fs_recovery.c b/gfs2/fsck/fs_recovery.c
index 3d8fe98..095d118 100644
--- a/gfs2/fsck/fs_recovery.c
+++ b/gfs2/fsck/fs_recovery.c
@@ -631,6 +631,7 @@ static int rangecheck_jmeta(struct gfs2_inode *ip, uint64_t block,
 				 (unsigned long long)block,
 				 (unsigned long long)block);
 			brelse(*bh);
+			*bh = NULL;
 			return meta_skip_further;
 		}
 	}
diff --git a/gfs2/fsck/metawalk.c b/gfs2/fsck/metawalk.c
index 1875b24..16faafb 100644
--- a/gfs2/fsck/metawalk.c
+++ b/gfs2/fsck/metawalk.c
@@ -1203,7 +1203,7 @@ static void free_metalist(struct gfs2_inode *ip, osi_list_t *mlp)
 			nbh = osi_list_entry(list->next,
 					     struct gfs2_buffer_head, b_altlist);
 			if (nbh == ip->i_bh)
-				osi_list_del(&nbh->b_altlist);
+				osi_list_del_init(&nbh->b_altlist);
 			else
 				brelse(nbh);
 		}


More information about the cluster-commits mailing list