Thread (6 messages) 6 messages, 3 authors, 2014-09-22

Re: [PATCH] Btrfs-progs: super-recover: fix double free fs_devices memory

From: Gui Hecheng <hidden>
Date: 2014-09-18 09:24:19

On Thu, 2014-09-18 at 05:01 -0400, Wang Shilong wrote:
quoted hunk ↗ jump to hunk
super-recover collects btrfs devices infomation using existed
functions scan_one_devices().

Problem is fs_devices is freed twice in close_ctree() and
free_recover_superblock() for super correction path.

Fix this problem by checking whether fs_devices memory
have been freed before we free it.

Cc: Eric Sandeen <redacted>
Cc: Chris Murphy <redacted>
Signed-off-by: Wang Shilong <redacted>
---
 super-recover.c | 13 +++----------
 1 file changed, 3 insertions(+), 10 deletions(-)
diff --git a/super-recover.c b/super-recover.c
index 767de4b..419b86a 100644
--- a/super-recover.c
+++ b/super-recover.c
@@ -69,21 +69,11 @@ void init_recover_superblock(struct btrfs_recover_superblock *recover)
 static
 void free_recover_superblock(struct btrfs_recover_superblock *recover)
 {
-	struct btrfs_device *device;
 	struct super_block_record *record;
 
 	if (!recover->fs_devices)
 		return;
 
-	while (!list_empty(&recover->fs_devices->devices)) {
-		device = list_entry(recover->fs_devices->devices.next,
-				struct btrfs_device, dev_list);
-		list_del_init(&device->dev_list);
-		free(device->name);
-		free(device);
-	}
-	free(recover->fs_devices);
-
 	while (!list_empty(&recover->good_supers)) {
 		record = list_entry(recover->good_supers.next,
 				struct super_block_record, list);
@@ -341,6 +331,9 @@ int btrfs_recover_superblocks(const char *dname,
 no_recover:
 	recover_err_str(ret);
 	free_recover_superblock(&recover);
+	/* check if we have freed fs_deivces in close_ctree() */
+	if (!root)
+		btrfs_close_devices(recover.fs_devices);
 	return ret;
 }
 
nice catch! "+20, recorded". ^_^
Keyboard shortcuts
hback out one level
jnext message in thread
kprevious message in thread
ldrill in
Escclose help / fold thread tree
?toggle this help