[PATCH] xfs: avoid double-free in xfs_attr_node_addname

[PATCH] xfs: avoid double-free in xfs_attr_node_addname

[Eric Sandeen]

xfs_attr_node_addname()'s error handling tests whether it
should free "state" in the out: error handling label:

out:
        if (state)
                xfs_da_state_free(state);

but an earlier free doesn't set state to NULL afterwards; this
could lead to a double free.  Fix it by setting state to NULL
after it's freed.

This was found by Coverity.

Signed-off-by: Eric Sandeen <sandeen@redhat.com>
---

Note: Exact same patch should hit xfsprogs - I could send another,
or maybe SGI can just apply it in both trees?

Thanks,
-Eric

diff --git a/fs/xfs/xfs_attr.c b/fs/xfs/xfs_attr.c
index 20fe3fe..aaff8a9 100644
--- a/fs/xfs/xfs_attr.c
+++ b/fs/xfs/xfs_attr.c
@@ -1260,6 +1260,7 @@ restart:
 			 * have been a b-tree.
 			 */
 			xfs_da_state_free(state);
+			state = NULL;
 			xfs_bmap_init(args->flist, args->firstblock);
 			error = xfs_attr3_leaf_to_node(args);
 			if (!error) {

_______________________________________________
xfs mailing list
xfs@oss.sgi.com
http://oss.sgi.com/mailman/listinfo/xfs

Re: [PATCH] xfs: avoid double-free in xfs_attr_node_addname

[Mark Tinguely]

On 07/31/13 20:18, Eric Sandeen wrote:
> xfs_attr_node_addname()'s error handling tests whether it
> should free "state" in the out: error handling label:
>
> out:
>          if (state)
>                  xfs_da_state_free(state);
>
> but an earlier free doesn't set state to NULL afterwards; this
> could lead to a double free.  Fix it by setting state to NULL
> after it's freed.
>
> This was found by Coverity.
>
> Signed-off-by: Eric Sandeen<sandeen@redhat.com>
> ---
>
> Note: Exact same patch should hit xfsprogs - I could send another,
> or maybe SGI can just apply it in both trees?
>
> Thanks,
> -Eric

Looks good. we will discuss the details at PM phone call.

Reviewed-by: Mark Tinguely <tinguely@sgi.com>

_______________________________________________
xfs mailing list
xfs@oss.sgi.com
http://oss.sgi.com/mailman/listinfo/xfs

Re: [PATCH] xfs: avoid double-free in xfs_attr_node_addname

[Ben Myers]

On Wed, Jul 31, 2013 at 08:18:54PM -0500, Eric Sandeen wrote:
> xfs_attr_node_addname()'s error handling tests whether it
> should free "state" in the out: error handling label:
> 
> out:
>         if (state)
>                 xfs_da_state_free(state);
> 
> but an earlier free doesn't set state to NULL afterwards; this
> could lead to a double free.  Fix it by setting state to NULL
> after it's freed.
> 
> This was found by Coverity.
> 
> Signed-off-by: Eric Sandeen <sandeen@redhat.com>

Applied.

_______________________________________________
xfs mailing list
xfs@oss.sgi.com
http://oss.sgi.com/mailman/listinfo/xfs