From mboxrd@z Thu Jan 1 00:00:00 1970 From: Bob Peterson Date: Thu, 15 Jan 2015 11:37:24 -0500 (EST) Subject: [Cluster-devel] [fsck.gfs2 PATCH] fsck.gfs2: fix double-free bug In-Reply-To: <241158374.10019922.1421339782799.JavaMail.zimbra@redhat.com> Message-ID: <1157015321.10022440.1421339844710.JavaMail.zimbra@redhat.com> List-Id: To: cluster-devel.redhat.com MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Hi, This patch fixes a double-free bug that can occur when errors are found in an inode and later, it's freed. The problem is that function free_metalist was using osi_list_del when removing buffer_heads from the inode in memory. It should be using osi_list_del_init so that the list head is reinitialized. Otherwise the list head is left with an unknown value which gets interpreted later on as !list_empty(), so it tries to free the list a second time. This also fixes a minor issue with function rangecheck_jmeta, which frees the buffer_head when it's done. The patch sets the returned *bh value back to NULL to ensure it's not reused. This is just a precaution I spotted while debugging, and it's worth doing. Regards, Bob Peterson Red Hat File Systems Signed-off-by: Bob Peterson --- diff --git a/gfs2/fsck/fs_recovery.c b/gfs2/fsck/fs_recovery.c index 3d8fe98..095d118 100644 --- a/gfs2/fsck/fs_recovery.c +++ b/gfs2/fsck/fs_recovery.c @@ -631,6 +631,7 @@ static int rangecheck_jmeta(struct gfs2_inode *ip, uint64_t block, (unsigned long long)block, (unsigned long long)block); brelse(*bh); + *bh = NULL; return meta_skip_further; } } diff --git a/gfs2/fsck/metawalk.c b/gfs2/fsck/metawalk.c index 1875b24..16faafb 100644 --- a/gfs2/fsck/metawalk.c +++ b/gfs2/fsck/metawalk.c @@ -1203,7 +1203,7 @@ static void free_metalist(struct gfs2_inode *ip, osi_list_t *mlp) nbh = osi_list_entry(list->next, struct gfs2_buffer_head, b_altlist); if (nbh == ip->i_bh) - osi_list_del(&nbh->b_altlist); + osi_list_del_init(&nbh->b_altlist); else brelse(nbh); }