Re: [PATCH] Btrfs-progs: super-recover: fix double free fs_devices memory
From: Gui Hecheng <hidden>
Date: 2014-09-18 09:24:19
On Thu, 2014-09-18 at 05:01 -0400, Wang Shilong wrote:
quoted hunk ↗ jump to hunk
super-recover collects btrfs devices infomation using existed functions scan_one_devices(). Problem is fs_devices is freed twice in close_ctree() and free_recover_superblock() for super correction path. Fix this problem by checking whether fs_devices memory have been freed before we free it. Cc: Eric Sandeen <redacted> Cc: Chris Murphy <redacted> Signed-off-by: Wang Shilong <redacted> --- super-recover.c | 13 +++---------- 1 file changed, 3 insertions(+), 10 deletions(-)diff --git a/super-recover.c b/super-recover.c index 767de4b..419b86a 100644 --- a/super-recover.c +++ b/super-recover.c@@ -69,21 +69,11 @@ void init_recover_superblock(struct btrfs_recover_superblock *recover) static void free_recover_superblock(struct btrfs_recover_superblock *recover) { - struct btrfs_device *device; struct super_block_record *record; if (!recover->fs_devices) return; - while (!list_empty(&recover->fs_devices->devices)) { - device = list_entry(recover->fs_devices->devices.next, - struct btrfs_device, dev_list); - list_del_init(&device->dev_list); - free(device->name); - free(device); - } - free(recover->fs_devices); - while (!list_empty(&recover->good_supers)) { record = list_entry(recover->good_supers.next, struct super_block_record, list);@@ -341,6 +331,9 @@ int btrfs_recover_superblocks(const char *dname, no_recover: recover_err_str(ret); free_recover_superblock(&recover); + /* check if we have freed fs_deivces in close_ctree() */ + if (!root) + btrfs_close_devices(recover.fs_devices); return ret; }
nice catch! "+20, recorded". ^_^