I found the following patch is insufficient.
===============================================================================
commit 6e6b32ddf58db54f714d0f263c2589f4859e8b5e
Author: Adam Buchbinder <abuchbinder@xxxxxxxxxx>
Date: Fri Jun 13 16:43:56 2014 -0700
btrfs-progs: Fix a use-after-free in the volumes code.
===============================================================================
"btrfs filesystem show <dev>" with this patch causes segmentation fault
if "<dev>" is a not-mounted Btrfs filesystem.
===============================================================================
# ./btrfs filesystem show /dev/sdd1
Label: none uuid: <cut here>
Total devices 1 FS bytes used 112.00KiB
devid 1 size 59.12GiB used 2.04GiB path /dev/sdd1
Segmentation fault (core dumped)
===============================================================================
It's due to double-free of fs_devices->list as follows.
===============================================================================
cmd_show
-> list_del(&fs_devices->list) # 1st one.
-> btrfs_close_devices(fs_devices)
-> list_del(&fs_devices->list) # <- 2nd one introduced at 6e6b32dd.
Double-free happens here.
===============================================================================
First list_del() can safely be removed because fs_devices->list will be
deleted by second one, soon.
Signed-off-by: Satoru Takeuchi <takeuchi_satoru@xxxxxxxxxxxxxx>
Cc: Adam Buchbinder <abuchbinder@xxxxxxxxxx>
---
cmds-filesystem.c | 1 -
1 file changed, 1 deletion(-)
diff --git a/cmds-filesystem.c b/cmds-filesystem.c
index b1ba508..14cb6e0 100644
--- a/cmds-filesystem.c
+++ b/cmds-filesystem.c
@@ -716,7 +716,6 @@ devs_only:
while (!list_empty(all_uuids)) {
fs_devices = list_entry(all_uuids->next,
struct btrfs_fs_devices, list);
- list_del(&fs_devices->list);
btrfs_close_devices(fs_devices);
}
out:
--
1.9.3
--
To unsubscribe from this list: send the line "unsubscribe linux-btrfs" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
