[Cluster-devel] [fsck.gfs2 PATCH] fsck.gfs2: fix double-free bug

[Bob Peterson <rpeterso@redhat.com>]

Hi,

This patch fixes a double-free bug that can occur when errors are found
in an inode and later, it's freed. The problem is that function
free_metalist was using osi_list_del when removing buffer_heads from the
inode in memory. It should be using osi_list_del_init so that the list
head is reinitialized. Otherwise the list head is left with an unknown
value which gets interpreted later on as !list_empty(), so it tries to
free the list a second time.

This also fixes a minor issue with function rangecheck_jmeta, which
frees the buffer_head when it's done. The patch sets the returned *bh
value back to NULL to ensure it's not reused. This is just a precaution
I spotted while debugging, and it's worth doing.

Regards,

Bob Peterson
Red Hat File Systems

Signed-off-by: Bob Peterson <rpeterso@redhat.com> 
---
diff --git a/gfs2/fsck/fs_recovery.c b/gfs2/fsck/fs_recovery.c
index 3d8fe98..095d118 100644
--- a/gfs2/fsck/fs_recovery.c
+++ b/gfs2/fsck/fs_recovery.c
@@ -631,6 +631,7 @@ static int rangecheck_jmeta(struct gfs2_inode *ip, uint64_t block,
 				 (unsigned long long)block,
 				 (unsigned long long)block);
 			brelse(*bh);
+			*bh = NULL;
 			return meta_skip_further;
 		}
 	}
diff --git a/gfs2/fsck/metawalk.c b/gfs2/fsck/metawalk.c
index 1875b24..16faafb 100644
--- a/gfs2/fsck/metawalk.c
+++ b/gfs2/fsck/metawalk.c
@@ -1203,7 +1203,7 @@ static void free_metalist(struct gfs2_inode *ip, osi_list_t *mlp)
 			nbh = osi_list_entry(list->next,
 					     struct gfs2_buffer_head, b_altlist);
 			if (nbh == ip->i_bh)
-				osi_list_del(&nbh->b_altlist);
+				osi_list_del_init(&nbh->b_altlist);
 			else
 				brelse(nbh);
 		}