The subvol sync command crashed randomly at the end with
*** glibc detected *** btrfs: double free or corruption (out): 0x00000000006ab040 ***
This is caused by running out of the ids array in case there are more
than 128 subvolumes. The array is increased in steps but does not
account the size of the item, so there was room for 1024 / 8 = 128
subvolume ids.
Fixes: c9f885ec8963 ("btrfs-progs: subvol: let sync check only current deletions")
Signed-off-by: David Sterba <dsterba@xxxxxxxx>
---
cmds-subvolume.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/cmds-subvolume.c b/cmds-subvolume.c
index 02e1dec18ed2..32caaa5db9ec 100644
--- a/cmds-subvolume.c
+++ b/cmds-subvolume.c
@@ -1204,7 +1204,8 @@ static int enumerate_dead_subvols(int fd, u64 **ids)
u64 *newids;
count += SUBVOL_ID_BATCH;
- newids = (u64*)realloc(*ids, count);
+ newids = (u64*)realloc(*ids,
+ count * sizeof(u64));
if (!newids)
return -ENOMEM;
*ids = newids;
--
2.7.1
--
To unsubscribe from this list: send the line "unsubscribe linux-btrfs" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
